is this statement correct?

[mary bate]

String employee_name=request.getParameter("employee_name");

String queryText = "insert into sshl_account_application (employee_name)values('" + request.getParameter('employee_name')");

[Afroz Ahmed]

Hai,
The query is not correctly concatenated.Here is the modified one

String employee_name=request.getParameter("employee_name");
String queryText = "insert into sshl_account_application (employee_name)values('" + request.getParameter("employee_name") +"')" ;

[Ameya Thakur]

Hi Mary,

The Corrected Query is

String queryText = "insert into sshl_account_application (employee_name) values('" +request.getParameter('employee_name')+")";

Regards

Ameya

[Ameya Thakur]

Hi,

String queryText = "insert into sshl_account_application (employee_name) values(" +request.getParameter('employee_name')+")";

Regards

Ameya

[Peter den Haan]

String queryText = "insert into sshl_account_application (employee_name) values(" 
      + request.getParameter('employee_name') + ")";

Please promise me that this is just some code to play around with, and that you will never, ever allow anything like this into any kind of production environment. Allowing an HTTP request parameter into your SQL text like this means that a malicious user can do anything they like with your database through SQL injection.

In production, you should always use a PreparedStatement here.

- Peter
[ August 05, 2004: Message edited by: Peter den Haan ]