Re: [update request]problem with parameter value

[Todd Farmer]

Hi Serge,

You need to escape this.name. Passing input directly into literal SQL strings is a pretty bad idea - you'll want to Google "SQL Injection" and see what can be done when input isn't properly validated and prepared.

JDBC provides a nice mechanism to help avoid this, via PreparedStatement. Try this instead:

try{
PreparedStatement pstm= con.prepareStatement("INSERT INTO tblclients(firstname) VALUES ( ? )");
pstm.setString(1, this.name);
psmt.executeUpdate();
...

--
Todd Farmer
MySQL @ Oracle
http://www.oracle.com/mysql/