Re: How does postgres handle non literal string values

monroy(at)mindspring(dot)com (javaholic) writes:

> String insertString =
> "INSERT INTO \"login\" ('user', 'password')
> VALUES ('username', 'password')";

First, your SQL syntax is wrong (field names in an INSERT shouldn't be
quoted), and second, Java isn't Perl--it won't magically interpolate
variable values into a string. Try:

String insertString =
"INSERT INTO \"login\" (user, password) VALUES ('" + username
+ "', '" + password + "')";

This will work but has a gaping security hole. Even better, use a
PreparedStatement instead--it's much cleaner and is immune to SQL
injection attacks.

-Doug