comparing user-entered data to SQL database data

Question

I'm trying to compare a user-entered value(student id) to the student_id value in the mysql database. I want to have the user enter a student id and return a string saying "Is (student_name) the correct student?" with the student_name coming from the database. This is what I have so far, the signUp() is part of a switch statement. I think the problem is coming from the user_entered_student_id variable. I'm trying to have that be the user-entered id, but when I try to run the program it says that variable is never used. Any ideas would help!

    static void signUp() {
        System.out.println("\nSign Up For a Class\n");
        try {
            Scanner input = new Scanner(System.in);
            System.out.println("Enter Student ID: ");
            String user_entered_student_id = input.nextLine();
            Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/ClassSelector", "", "");
            Statement myStmt = con.createStatement();
            ResultSet rs;
            rs = myStmt.executeQuery("SELECT student_name FROM ClassSelector.students WHERE student_id =" + user_entered_student_id");
            while (rs.next()) {
                String userEnterId = rs.getString("student_name");
                System.out.println("Is " + userEnterId + " the correct student?");


 String confirm = input.nextLine();
                    if(confirm == "Y"){
                    System.out.println("Enter ID From Classes Available: ");
                    System.out.println("SELECT * FROM ClassSelector.classes");
                    }
                }
            } catch (Exception exc) {
                exc.printStackTrace();
            }
        }

Use PreparedStatement and pass your parameter.

PM 77-1
– PM 77-1

2016-02-26 23:08:07 +00:00
Commented Feb 26, 2016 at 23:08 — PM 77-1
– PM 77-1, Commented Feb 26, 2016 at 23:08

Maciej Dobrowolski · Accepted Answer · 2016-02-26 23:05:25Z

2

This statement does not use user_entered_student_id variable:

ResultSet rs = myStmt.executeQuery(
    "SELECT student_name FROM ClassSelector.students " +
    "WHERE student_id = user_entered_student_id");

It should rather be:

ResultSet rs = myStmt.executeQuery(
    "SELECT student_name FROM ClassSelector.students " +
    "WHERE student_id = " + user_entered_student_id);

edited Feb 26, 2016 at 23:05

answered Feb 26, 2016 at 22:59

Maciej Dobrowolski

12.2k5 gold badges50 silver badges71 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Maciej Dobrowolski Over a year ago

@Rassisland as PM 77-1 already pointed out in the comment below your question - you should use PreparedStatement to create query with parameters - it's safer and easier to avoid such mistakes.

Rassisland Over a year ago

I updated the code and added an extra bit that isn't working either. I'm trying to get the confirm "Y" to run the code, but after I enter a Y, it just resets and doesn't print the last two lines, any ideads?

Maciej Dobrowolski Over a year ago

@Rassisland, Strings comparision should be done via String#equals method. In your case it should be confirm.equals("Y")

Collectives™ on Stack Overflow

comparing user-entered data to SQL database data

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related