Insert data into database using jsp
I need to insert data from a form into a DB, I tried this code, it worked, but now it doesn't work. I want to know where is the problem with this code.
this is the code
Connection con = null;
try{
String driveName = "com.mysql.jdbc.Driver";
Class.forName(driveName).newInstance();
} catch(java.lang.ClassNotFoundException e) {
System.err.print("ClassNotFoundException: ");
System.err.println(e.getMessage());
}
try{
con = DriverManager.getConnection("jdbc:mysql://localhost:3306/onlinequiz","root","root");
Statement statement =con.createStatement();
// int id=Integer.parseInt(request.getParameter("T1"));
int quizID = Integer.parseInt(request.getParameter("quizID"));
String take2 = request.getParameter ("question_type"); String rate = request.getParameter ("rate"); String level = request.getParameter ("level");
int duration = Integer.parseInt (request.getParameter ("duration"));
String title = request.getParameter ("Title"); String Description = request.getParameter ("Description");
statement.executeUpdate ("insert into quiz (current, Tiltle, Description, quizID, question_type, duration, level) values ('" + course + "', '" + Title + "', '" + Description + "' , '"+ quizID +",' + Take2 + ',' + duration + ',' + level + ') ");
%>
<%
statement.close();
} catch ( Exception e ) {
out.println( "Exception: " + e.getMessage() );
}
// execute the statements even if the exception occurs
finally{
}
%>
I have tried and edited this code and it works, I made some changes, I want the user to select in the type question, which is a dropdown box that encodes multiple choice, or true false, should I write an if statement that the user passes in his own way choice.
Does the code above provide an exception when executed? If so, can you copy / paste the exception message into the message?
Also, you shouldn't directly add user input to the insert query, it is susceptible to SQL injection attacks. Instead, use prepared statements and consider using a proper Model-View-Control architecture using the data access layer for all database transactions.