0


I am unable to delete data, from DB(MySql), with spaces for example:
"blabla blabla" or " blabla", but data without spaces deleting: "blablabla"

Here is how I get value in JSP:

<a href=deleteData?id=<%= rs.getString(1)></a>

and the deleteData - servlet

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.Statement;

@WebServlet("/deleteData")
public class deleteData extends HttpServlet {

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

    String value = request.getParameter("id");


    try {
        Class.forName("com.mysql.jdbc.Driver");
        Connection conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/evernoteDB",
                "evernoteDB", "0633739768z");


        Statement st = conn.createStatement();

        st.executeUpdate("DELETE FROM note WHERE noteName='" + value  + "'");

        response.sendRedirect("/userNotes.jsp");

        conn.close();
    } catch (Exception e) {
        e.printStackTrace();
    }
}

} I think the problem is in - getString function, but on oracle website it is mentioned that this function is getting all the rows, I am disappointed

Mohit Kanwar
  • 2,962
  • 7
  • 39
  • 59
Yaroslav Pidmohylniy
  • 313
  • 1
  • 3
  • 8
  • Well, for starters, use a `PreparedStatement`; as it stands now, your code falls prey to SQL injection. – fge Jul 05 '15 at 16:19
  • @fge is right. I recommended the same yesterday on your last question I answered for you. Please get into the habit of using best practices as soon as possible. Putting them off would just get in your way of improving your skills. And using `PreparedStatement` is just barely two extra lines! – Ravi K Thapliyal Jul 05 '15 at 16:22
  • @RaviThapliyal Thank you I though that PreparedStatement does not solve this problem – Yaroslav Pidmohylniy Jul 05 '15 at 16:24
  • There's actually a bigger problem here. You're using the data itself as your key. You should instead introduce a numeric primary key and not hack around the spaces as suggested in the answer below. – Ravi K Thapliyal Jul 05 '15 at 16:28
  • Yes, PreparedStatement doesn't solve your space issue but it does make your program safer for your users to use. It's not just a fancy method call we're recommending here. – Ravi K Thapliyal Jul 05 '15 at 16:33
  • @RaviThapliyal ok i had tried to use 'id' with auto_increment but I cannot connect to id, and how to create new column and use there my own counter I do not know (the problem was in right counter for my own id column) – Yaroslav Pidmohylniy Jul 05 '15 at 16:42

1 Answers1

0

You are redirecting in your href and the spaces in the URL are translated to %20 that's why when you pass "blabla blabla" your delete is not matching results. You should sanitize your value.

Uggly fast way:

Replace %20 for an empty string

Right way:Java: How to unescape HTML character entities in Java?

Community
  • 1
  • 1
Frankely Diaz
  • 886
  • 1
  • 9
  • 16