query trouble

[Anand Shrivastava]

kindly see the following code

pgres.otherquery("insert into coderanch.author (authorname) values ('"+jComboBox3.getSelectedItem().toString().trim()+"'");
pgres.otherquery("insert into coderanch.subject (subject) values ('" + jComboBox1.getSelectedItem().toString().trim()+"'");
aset = pgres.selectquery("select authid from coderanch.author where authorname =" + jComboBox3.getSelectedItem());
sset = pgres.selectquery("select sid from coderanch.subject where subject =" + jComboBox1.getSelectedIndex());
try {
pgres.otherquery("insert into coderanch.author_subject values (" + aset.getInt("authorid")+", "+sset.getInt("sid") +")");
}
catch (Exception E) {System.out.println(E.getMessage());}

it gives the error message syntax error at the end of input. Probably this is the error message returned by the database.

[Ernest Friedman-Hill]

Don't do this -- use PreparedStatement. It will handle the quoting for you and whatever mistake you've made here, won't happen. Furthermore, it's far more secure -- code like this leaves you wide open for SQL injection attacks!

I'm moving this to our JDBC forum for any follow-up.