equivalent of String.Format() in Java -
i have peace of code :
string query = "select * utilisateurs pseudo = '" + pseudo.gettext()+ "' , password = '" + new string(password.getpassword()) + "'";
my question : isn't there other method concat these variables string ?
in c# using method string.format() method :
string query = string.format("select * utilisateurs pseudo = '{0}' , password = '{1}'", pseudo.gettext(), new string(password.getpassword()));
string.format()
can used format strings, javadoc.
public static string format(string format, object... args)
returns formatted string using specified format string , arguments.
however when comes building sql query strings preferred way use preparedstatement
(javadoc) it:
- protects sql injection
- allows database cache query (build query plan once)
your code using preparedstatement
might below:
final preparedstatement pstmt = con.preparestatement( "select * utilisateurs pseudo = ? , password = ?"); pstmt.setstring(1, pseudo.gettext()); pstmt.setstring(2, new string(password.getpassword())); final resultset rs = pstmt.executequery();
Comments
Post a Comment