Java SQLite : no such column error

Question

I'm writing a Java app which has to add a record to a database. Everything works fine until I want to add a local variable to the database (I think I'm placing my parentheses wrong or something). Anyway, I'm tired of looking for the problem and would appreciate some help.

My code:

public void newUser(int userID, String userName, String credentials) {
    try {
        Class.forName("org.sqlite.JDBC");
        conn = DriverManager
                .getConnection("jdbc:sqlite:c:/temp/alarmsystem.db");
        Statement statement = conn.createStatement();
        statement.execute("insert into Users values(" + 1 + "," + userName
                + "," + "'Helloskit'" + ") ");
        core.printToConsole("created");
        ResultSet rs = statement.executeQuery("select * from Users");

        while (rs.next()) {
            String s = rs.getString("Username");

            core.printToConsole("name = " + s);

        }
    } catch (Exception e) {
    }
}

The error:

java.sql.SQLException: no such column: Tombellens
at org.sqlite.DB.throwex(DB.java:288)
at org.sqlite.NestedDB.prepare(NestedDB.java:115)
at org.sqlite.DB.prepare(DB.java:114)
at org.sqlite.Stmt.execute(Stmt.java:82)
at me.server.DBCommunications.DBConnection.newUser(DBConnection.java:59)
at me.server.Core.Core.newUser(Core.java:61)
at me.server.LocalUser.Console.main(Console.java:72)

Thanks, Tom

WARNING your code is susceptible to sql injection attacks. — Daniel A. White
– Daniel A. White, Commented Feb 18, 2012 at 22:41
@Thomas you have to put username as 'Robert'); DROP TABLE Users; --' as ' is missing in the query...;) — havexz
– havexz, Commented Feb 19, 2012 at 3:44

havexz · Accepted Answer · 2012-02-18 22:43:29Z

19

The problem is the in query. The userName variable is not enclosed in quotes

Use below code:

statement.execute("insert into Users values(" + 1 + ",'"  +  userName  + "',"  + "'Helloskit'" +") ");

answered Feb 18, 2012 at 22:43

havexz

9,6202 gold badges36 silver badges30 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

havexz Over a year ago

@Lion why? It looks like a string literal to me.

Donal Fellows Over a year ago

I know of someone who's family name is “O'Sullivan”. Single quotes happen in real data. Use prepared statements.

Philip Sheard · Accepted Answer · 2012-02-18 22:45:32Z

1

In your SQL statement, the variable userName should be in quotes.

answered Feb 18, 2012 at 22:45

Philip Sheard

5,8335 gold badges30 silver badges42 bronze badges

Collectives™ on Stack Overflow

Java SQLite : no such column error

2 Answers 2

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related