JSP插入数据时报的错误

Question

错误信息：
org.apache.jasper.JasperException: Exception in JSP: /deal.jsp:2522:  out.println("数据库连接出错");
23:  }
24:   command ="insert into article(title,content,type,source,riqi) VALUES("+title+","+content+","+type+","+source+","+datestr+")";
25:   stmt.executeUpdate(command);
26:   stmt.close();
27:   conn.close();
28:   out.println("操作成功");
源代码：
<%! String datestr,title,type,source,content,command;
    Connection conn;
Statement stmt;%>
<% title=request.getParameter("title");
   type=request.getParameter("type");
   source=request.getParameter("source");
   content=request.getParameter("content");
  java.text.DateFormat df = new java.text.SimpleDateFormat("yyyy-M-d HH:ss") ;
  java.util.Date date = new java.util.Date() ;   
  datestr = df.format(new java.util.Date()) ; 
  out.println(title+","+type+","+source+","+content+","+datestr); 
  if(title!=null)
  {
  try{
  Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
  conn=DriverManager.getConnection("jdbc:odbc:mysite","sa","851009");
  stmt=conn.createStatement();
  } catch (Exception e) {
    e.printStackTrace();
out.println("数据库连接出错");
}
  command ="insert into article(title,content,type,source,riqi) VALUES("+title+","+content+","+type+","+source+","+datestr+")";
  stmt.executeUpdate(command);
  stmt.close();
  conn.close();
  out.println("操作成功");
  }
  else
  {
  out.println("操作失败");
  }
%>

Answer 1

语句中填充的参数都没有加单引号