Hi iam tring to insert value in database using bean class in jsp form and i am able to this but i am getting little bit problem whenever i insert value in table null value also insert with them i tried not i am not able to get that where i m wrong please solve my problem
my bean.java
package com.javabean;
import java.io.*;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.Statement;
import java.sql.ResultSet;
public class bean
{
private String msgid;
private String message;
private Connection connection=null;
private ResultSet rs = null;
private Statement st = null;
String connectionURL = "jdbc:mysql://localhost:3306/JspBean";
public bean()
{
try {
// Load the database driver
Class.forName("com.mysql.jdbc.Driver");
// Get a Connection to the database
connection = DriverManager.getConnection(connectionURL, "root", "");
}catch(Exception e){
System.out.println("Exception is ;"+e);
}
}
public void setmsgid(String msgid)
{
this.msgid = msgid;
}
public String getmsgid()
{
return (this.msgid);
}
public void setmessage(String message)
{
this.message = message;
}
public String getmessage()
{
return (this.message);
}
public void insert()
{
try
{
String sql = "insert into login(messageid,message) values('"+msgid+"','"+message+"')";
Statement s = connection.createStatement();
s.executeUpdate (sql);
s.close ();
}catch(Exception e){
System.out.println("Exception is ;"+e);
}
}
}
here is my jspbean.jsp file
<%@ page language="Java" import="java.sql.*" %>
<html>
<head><title>JSP with Javabeans</title></head>
<body bgcolor="#ffccff">
<h1>JSP using JavaBeans example</h1>
<form name="form1" method="POST">
ID
<input type="text" name ="msgid"> <br>
Message<input type="text" name ="message"> <br>
<br>
<input type = "submit" value="Submit">
<jsp:useBean id="sample" class="com.javabean.bean" scope="page">
<jsp:setProperty name="sample" property="*"/>
</jsp:useBean>
</form>
<% sample.insert();%>
</body>
</html>
how can i achieve this please solve my problem hanks in advance T
PreparedStatements and pass in the values to your insert as parameters. Concatenation like you are doing leads to problems like SQL injection. Enough of my soapbox.