From: "Rob Hills" <rob@netpaver.com.au>
Organization: NetPaver Pty Ltd
To: pgsql-sql@postgresql.org
Date: Wed, 27 Nov 2002 01:18:02 +0800
MIME-Version: 1.0
Subject: Re: How does postgres handle non literal string values
Reply-To: rob.hills@netpaver.com.au
Message-ID: <3DE41D4A.9268.9F992F@localhost>
In-reply-to: <8adde2e2.0211250457.3f0d1c7c@posting.google.com>
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Content-description: Mail message body

Hi,

On 25 Nov 2002 at 4:57, javaholic wrote:

Your problem is really a JSP one rather than a postgres problem, and probably doesn't 
really belong on this list.  That said, I know much more java/jsp than I do postgres, so I'll 
try and help.

> I have some jsp code that should insert a user name and password into
> a table called login.
> 
> Instead of inserting the values given by the client, it insert the
> literal string 'username' and 'password. The problem is somewhere in
> the INSERT statement.

Yup, your INSERT statement is doing exactly what you've asked it to do, inserting the 
literal strings 'username' and 'password' into the table.

> <%
>                         String insertString =
>                         "INSERT INTO  \"login\" (\'user\', \'password\')
> VALUES ('username', 'password')";
> %>

To do it correctly using JSP, try the following:

<% 
	String insertString = "INSERT INTO  \"login\" (\'user\', \'password\') 	
		VALUES ('" + username + "', '" + password + "')"; 
%>  

However, you would probably be better off using a PreparedStatement object rather 
than a Statement for various reasons, but especially to avoid trying to get the single- 
and double-quotes right in the above statement.

HTH,


Rob Hills
MBBS, Grad Dip Com Stud, MACS
Senior Consultant
Netpaver Web Solutions
Tel:	(0412) 904 357
Fax:	(08) 9485 2555
Email:	rob@netpaver.com.au