Using Prepared Statements to set Table Name

java sql prepared-statement
Brandon picture Brandon · Jul 30, 2009 · Viewed 27.3k times · Source

I'm trying to use prepared statements to set a table name to select data from, but I keep getting an error when I execute the query.

The error and sample code is displayed below.

[Microsoft][ODBC Microsoft Access Driver] Parameter 'Pa_RaM000' specified where a table name is required.



private String query1 = "SELECT plantID, edrman, plant, vaxnode FROM [?]"; //?=date
public Execute(String reportDate){
    try {

        Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
        Connection conn = DriverManager.getConnection(Display.DB_MERC);
        PreparedStatement st = conn.prepareStatement(query1);
        st.setString(1, reportDate);
        ResultSet rs = st.executeQuery();

Any thoughts on what might be causing this?

Answer

camickr picture camickr · Jul 30, 2009

A table name can't be used as a parameter. It must be hard coded. So you can do something like:

private String query1 = "SELECT plantID, edrman, plant, vaxnode FROM [" + reportDate + "?]";

Related questions

How can I get the SQL of a PreparedStatement?

I have a general Java method with the following method signature: private static ResultSet runSQLResultSet(String sql, Object... queryParams) It opens a connection, builds a PreparedStatement using the sql statement and the parameters in the queryParams variable length array, runs …

Read More
Using setDate in PreparedStatement

In order to make our code more standard, we were asked to change all the places where we hardcoded our SQL variables to prepared statements and bind the variables instead. I am however facing a problem with the setDate(). Here …

Read More
How does a PreparedStatement avoid or prevent SQL injection?

I know that PreparedStatements avoid/prevent SQL Injection. How does it do that? Will the final form query that is constructed using PreparedStatements will be a string or otherwise?

Read More