java - Java-如何在SQLite中插入值？

我从SQLite开始，我创建了数据库，并且连接正常。
当我尝试插入值(数据库为空)时，出现以下错误:

import java.sql.*;

public class connection{
    String route = "C:\\Freeman SA.db";
    Connection c = null;
    Statement stat = null;
    String op;

    public void connect(){
        try{
            c = DriverManager.getConnection("jdbc:sqlite:"+route);
            if (c!=null)
                System.out.println("Connected to db.");
        }
        catch (SQLException ex) {
            System.err.println("Couldn't connect."+ex.getMessage());
        }
    }

    public void insert_DB(String NAME, String LNAME, String ID, int AGE, int TIME, int SALARY) throws SQLException{
        connect();
        try {
            stat = c.createStatement();
            op = "INSERT INTO Remuneraciones (Nombre, Apellido, Rut, Edad, Tiempo, Sueldo) VALUES (" + NAME + ", " + LNAME + ", " + ID + ", " + AGE + ", " + TIME + ", " + SALARY + ");";
            stat.executeUpdate(op);       //Here is the problem
            stat.close();
        }
        catch (SQLException e) {
            System.err.println(e.getClass().getName() + ": " + e.getMessage());
        }
        c.close();
    }
}

主要。

public static void main(String[] args) throws IOException {

        connection n = new connection();
        try {
            n.insert_DB("Charlie", "White", "18.954.621-K", 21, 2, 650000);
        } catch (SQLException ex) {
            Logger.getLogger(main.class.getName()).log(Level.SEVERE, null, ex);
        }
    }

PD:我从这里学习:http://www.tutorialspoint.com/sqlite/sqlite_java.htm

最佳答案

通过串联这样的字符串来创建SQL语句是一个坏主意。对SQL注入(inject)攻击和Little Bobby Tables进行一些研究。
PreparedStatement是一个更好的主意。验证后绑定(bind)变量。

看看这是否会使您的生活变得更好:

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.SQLException;
import java.sql.Statement;

/**
 * Demo RenumerationDao
 * Created by Michael
 * Creation date 6/8/2016.
 * @link https://stackoverflow.com/questions/37714254/java-how-can-i-insert-values-in-sqlite/37714292#37714292
 */
public class RenumerationDao {

    private static final String INSERT_SQL = "INSERT INTO Remuneraciones(Nombre, Apellido, Rut, Edad, Tiempo, Sueldo) VALUES(?, ?, ?, ?, ?, ?)";

    private Connection connection; // Better to get this from a pool.

    public RenumerationDao(Connection connection) {
        this.connection = connection;
    }

    public int insert(String firstName, String lastName, String id, int age, int timeInHours, int salary) {
        int numRowsInserted = 0;
        PreparedStatement ps = null;
        try {
            ps = this.connection.prepareStatement(INSERT_SQL);
            ps.setString(1, firstName);
            ps.setString(2, lastName);
            ps.setString(3, id);
            ps.setInt(4, timeInHours);
            ps.setInt(5, age);  // You'll have to update this each and every year. BirthDate would be better.
            ps.setInt(6, salary);
            numRowsInserted = ps.executeUpdate();

        } catch (SQLException e) {
            e.printStackTrace();
        } finally {
            close(ps);
        }
        return numRowsInserted;
    }

    public static void close(Statement statement) {
        try {
            if (statement != null) {
                statement.close();
            }
        } catch (SQLException e) {
            e.printStackTrace();
        }
    }
}