8 November, 2005
Using JDBC in Java Programs
JDBC allows you to access any data source for which you have an appropriate driver.
The relevant packages are java.sql and the more recent javax.sql.
In your Java code, first you need to load the driver. This can be done like this:
try {
Class.forName("org.gjt.mm.mysql.jdbc").newInstance();
} catch(InstantiationException e) {
e.printStackTrace();
}
That will load the driver. Next you need to get a Connection to the database server. For this you do something like the following:
try {
Connection conn = DriverManager.getConnection(
"mysql:jdbc://localhost/netspade", "username", "password");
} catch (SQLException e) {
e.printStackTrace();
}
Once you get the hang of this you will probably be interested in using a Connection pool to improve performance.
Now for using the Connection to do something. Now we actually want to execute some SQL. Here is a short example:
try {
Connection conn = DriverManager.getConnection(
"mysql:jdbc://localhost/netspade", "username", "password");
try {
Statement stmt=conn.createStatement();
try {
ResultSet results = stmt.executeQuery(
"select * from people where firstname='Jason'");
while (results.next()) {
System.out.println("Jason " + results.getString("lastname"));
}
} finally {
stmt.close();
}
} finally {
conn.close();
}
} catch (SQLException e) {
e.printStackTrace();
}
This is a short example but it forms the basis for most database queries that you might want to use. Notice the try ... finally blocks. These ensure that connections and statements are closed whatever happens.
results.next() iterates to the next row of the ResultSet. results.getString("colname") can be used to retrieve the value of that column in the current row. results.getString(colNumber) may be more efficient. There are corresponding get methods for each data type e.g. getInt() etc. Note that results.next() must be called before trying to get any data from the ResultSet.
If you want to execute SQL queries which contain values of variables you could do this: stmt.executeQuery("select * from people where firstname='"+firstName+"'"). But what if firstName contains any special SQL characters such as a ' character? There is an easy way to escape your variables:
try {
Connection conn = DatabaseConnection.getConnection();
try {
PreparedStatement stmt = conn.prepareStatement(
"select * from people where firstname=?");
try {
stmt.setEscapeProcessing(false);
stmt.setString(1,firstName);
ResultSet results = stmt.executeQuery();
try {
while (results.next()) {
System.out.println("Jason ");
System.out.println(results.getString("lastname"));
}
} finally {
results.close();
}
} finally {
stmt.close();
}
} finally {
conn.close();
}
} catch (SQLException e) {
e.printStackTrace();
}
Here I'm using a PreparedStatement instead of a Statement. A PreparedStatement escapes values for you when you use one of the set methods. To do this you insert ? characters where you want the values to appear. Then set the values in each ? using setXXX(index, value) where index is the number of the ? you want to set (note that index starts counting from 1).