Re: How does postgres handle non literal string values - Mailing list pgsql-general

monroy@mindspring.com (javaholic) writes:

>                         String insertString =
>                         "INSERT INTO  \"login\" ('user', 'password')
> VALUES ('username', 'password')";

First, your SQL syntax is wrong (field names in an INSERT shouldn't be
quoted), and second, Java isn't Perl--it won't magically interpolate
variable values into a string.  Try:

String insertString =
 "INSERT INTO  \"login\" (user, password) VALUES ('" + username
 + "', '" + password + "')";

This will work but has a gaping security hole.  Even better, use a
PreparedStatement instead--it's much cleaner and is immune to SQL
injection attacks.

-Doug