-1
My code to search in the BD by id
. The class is ContatoDao
:
//Pesquisa por id
public Contato pesquisaId(int id) {
String sql = "select nome from contatos where id = "+id;
Contato contato = null;
try {
PreparedStatement stmt = this.connection.prepareStatement(sql);
ResultSet rs = stmt.executeQuery(sql);
if(rs.next()) {
contato = new Contato();
contato.setId(rs.getLong("id"));
contato.setNome(rs.getString("nome"));
contato.setEmail(rs.getString("email"));
contato.setEndereco(rs.getString("endereco"));
}
rs.close();
stmt.close();
//return contato;
} catch (SQLException e) {
//throw new DAOException("Erro ao pesquisar no banco de dados pelo id.");
throw new RuntimeException(e);
}
return contato;
}
This other code is the test class code of this code above:
package br.com.caelum.jdbc.teste;
import br.com.caelum.jdbc.dao.ContatoDao;
import br.com.caelum.jdbc.modelo.Contato;
public class TestaPesquisaId {
public static void main(String[] args) {
ContatoDao dao = new ContatoDao();
Contato contato = dao.pesquisaId(1);
System.out.println("Nome: "+contato.getNome());
}
}
This is the error that shows on the console:
Exception in thread "main" java.lang.RuntimeException: java.sql.SQLException: Column 'id' not found.
at br.com.caelum.jdbc.dao.ContatoDao.pesquisaId(ContatoDao.java:101)
at br.com.caelum.jdbc.teste.TestaPesquisaId.main(TestaPesquisaId.java:11)
Caused by: java.sql.SQLException: Column 'id' not found.
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:129)
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:97)
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:89)
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:63)
at com.mysql.cj.jdbc.result.ResultSetImpl.findColumn(ResultSetImpl.java:556)
at com.mysql.cj.jdbc.result.ResultSetImpl.getLong(ResultSetImpl.java:829)
at br.com.caelum.jdbc.dao.ContatoDao.pesquisaId(ContatoDao.java:90)
... 1 more
One detail: This id
yes there in the bank, inserted with the method inserirContato
that I created.
Do not concatenate the ID in the query, this leaves the application vulnerable to attacks from SQL Injection. Prefer to use the setters of
PreparedStatement
, examples: https://www.baeldung.com/sql-injection#1parameterized-queries– hkotsubo