Click here to Skip to main content
15,892,839 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Here's my code
What's wrong with my code? Please help
public void actionPerformed(ActionEvent e){	
	if(e.getSource().equals(save))	{          //the save button
	
	try {
	    // connection string			
	        Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/PizzaOrders");
	        Statement st = con.createStatement();

	        st.executeUpdate("insert into Register VALUES('"
	                + CustomerID.getText() + "','" + fname.getText() + "','"
	                + lname.getText() + "','" + telnum.getText()
	                + "','" + city.getText() + "','" + zcode.getText()
	                + "','" + status.getText() + "','" + creditcard.getText()
	                + "','" + orderdate.getText() + "','" + deliveryfee.getText()
	                + "'," + "'" + quantity.getText() + "','"
	                + itemcost.getText() + "','" + TotalCost.getText() +"')");

	        JOptionPane.showConfirmDialog(null, "Orders saved!",
	                "Result", JOptionPane.DEFAULT_OPTION,
	                JOptionPane.PLAIN_MESSAGE);

	        st.close();
	        con.close(); 
	}catch(SQLException err){
		err.printStackTrace();
	}
}
Posted
Updated 27-Sep-14 6:09am
v2
Comments
Richard MacCutchan 27-Sep-14 12:15pm    
Firstly you are using string concatenation to build your insert statement, leaving you wide open to SQL injection attacks. Fix that before you do anything else. Also, if you have a problem then please describe it, do not just dump some code and ask us to figure out what it is supposed to do.

1 solution

!!!!DO NOT USE CONCATENATION TO FORM AN SQL STATEMENT!!!!
!!!!!ESPECIALLY WITH TEXT VALUES ENTERED BY THE USER!!!!!

Find out how to use a parameterized query in your framework.
 
Share this answer
 
Comments
Member 1nh 27-Sep-14 12:25pm    
ok i think i should change my code.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900