JSP JDBC executeUpdate 執行失敗：SQL 字符串拼接缺少引號

錯誤代碼

String sql = "insert into bookinfo(bookname,publisher,price) values(" + bookname + "," + publisher + "," + price + ")";
stmt.executeUpdate(sql);

錯誤信息

MySQLSyntaxErrorException: ... near '?,清åŽå¤§å­¦å‡ºç‰ˆç¤?,12.00)'

字符串值未加引號，且中文編碼亂碼進入 SQL。

修正方案

1. 參數化預編譯（推薦）：

String sql = "insert into bookinfo(bookname,publisher,price) values(?,?,?)";
PreparedStatement ps = conn.prepareStatement(sql);
ps.setString(1, bookname);
ps.setString(2, publisher);
ps.setString(3, price);
ps.executeUpdate();

2. 若必須拼接，字符串加單引號並處理轉義：

String sql = "insert ... values('" + bookname.replace("'", "''") + "','" + publisher.replace("'", "''") + "'," + price + ")";

同時確保 JSP 頁面編碼 pageEncoding="UTF-8"、數據庫連接 URL 加 characterEncoding=utf8、表字符集 UTF-8，解決中文亂碼。