Java JDBC Statement question?

[nick2price2003]

Making a little progress here, but i have a problem. I am using a Statement for this query, not a PreparedStatement. In my query i have the line
"WHERE Event_Name=`100M Run'";
where 100M Run is a String. but what do i do if my String is inside of an object called eveyType. How do i set it as an object? I have been trying stuff like
"WHERE Event_Name='"eveType2"'";
with the extra quotations, but its not working. How do i set an object without using a preparedstatement?

[rac <°?**?><]

You can't do it that way. Ideally, use a PreparedStatement set the where clause as: "WHERE Event_Name= ? ", then use ps.setString(1,eveyType.xxx);

Another, BAD method is to append them together like so:
"WHERE Event_Name = '" + eveyType.xxx + "'";
However this is very dangerous since it allows script injection. Basically whoever provides the value for the string (ie the user) could use it to force an SQL command to be executed in your database - and that includes dropping the table etc.

[JA12]

Use single quotes

"WHERE Event_Name='" + eveType2 + "'"