Syntax error in INSERT INTO statement

Question

I decided to add an "Add" button where Employee records are added to my Access Database, Employee table.

Whenever I clicked the "Add" button, an error message shows up saying "Syntax error in INSERT INTO statement". Can anybody help? Is there something wrong with my coding? Cause I really followed this video exactly, even though in the video, the person managed to successfully "Saved" the records to the database and I keep getting errors.

conn = Connect.ConnectDB();
        String sql = "insert into Employee ("
                +"Employee ID,"
                +"Employee Name,"
                +"Employee NICN,"
                +"Employee Gender,"
                +"Employee Contact Number,"
                +"Employee Department)"
                +"values("+txteid.getText()+ ",'"+txtename.getText()+"','"+txtenicn.getText()+"','"+txtegender.getText()+"','"+txtecnumber.getText()+"','"
                +txtedept.getText()+"')";
        try{
            pst = conn.prepareStatement(sql);
            pst.execute();
            JOptionPane.showMessageDialog(null, "Added");

        }catch(Exception e){
            JOptionPane.showMessageDialog(null, e);
        }

this is the video, that i referred to: youtube.com/watch?v=sqXtWlzwKM4 — user3717378
– user3717378, Commented Jun 7, 2014 at 8:16
Given that this code is vulnerable to SQL injection attacks, I would strongly advise you to find a different source of information. — Jon Skeet
– Jon Skeet, Commented Jun 7, 2014 at 8:17
Looking at the video, the author doesn't appear to follow Java naming conventions, either. I strongly advise that you read a decent book or tutorial on JDBC rather than learning anything from this. — Jon Skeet
– Jon Skeet, Commented Jun 7, 2014 at 8:18
Sure there was no underscore instead of space in the column names? Employee_ID etc, — Joop Eggen
– Joop Eggen, Commented Jun 7, 2014 at 8:33

Jens · Accepted Answer · 2014-06-07 08:24:10Z

1

You use prepared statement so you must work with parameter

   conn = getConnection();
   String sql = "insert into Employee ("
                +"Employee ID,"
                +"Employee Name,"
                +"Employee NICN,"
                +"Employee Gender,"
                +"Employee Contact Number,"
                +"Employee Department)"
                +"values(?,?,?,?,?,?)";

And then set the parameter:

      pstmt.setInt(1, txteid.getText()); // set input parameter 1
      pstmt.setString(2, txtename.getText()); // set input parameter 2
 ...
      pstmt.executeUpdate(); // execute insert statement

answered Jun 7, 2014 at 8:24

Jens

69.6k15 gold badges107 silver badges133 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Gord Thompson Over a year ago

Column names that contain spaces will also have to be enclosed in square brackets, e.g., [Employee ID].

Collectives™ on Stack Overflow

Syntax error in INSERT INTO statement

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related