关于Java与SQL的问题

Question

String s1=tf1.getText();
String s2=tf2.getText();
String s3=tf3.getText();
String s4=tf4.getText();
String s5=tf5.getText();
String s6=tf6.getText();
String s7=tf7.getText();
String s8=tf8.getText();
String JDriver="sun.jdbc.odbc.JdbcOdbcDriver";
String conURL="jdbc:odbc:TestDB";
try
{
Class.forName(JDriver);
}
catch(java.lang.ClassNotFoundException e)
{
System.out.println("ForName:"+e.getMessage());
}
    try
    {
     Connection con=DriverManager.getConnection(conURL);
     Statement s=con.createStatement();
     String r1="insert into person values("+"'s1','s2','s3','s4','s5','s6','s7','s8')";
     s.executeUpdate(r1);
     s.close();
     con.close();
    }
    catch(SQLException e)
    {
     System.out.println("SQLException:"+e.getMessage());
    }请问String r1="insert into person values("+"'s1','s2','s3','s4','s5','s6','s7','s8')";这一 有 有问题啊?
其中tf1～tf8为JTextField

Answer 1

String r1="insert into person values("+"'s1','s2','s3','s4','s5','s6','s7','s8')";因为你的String 写到引号里了。所以不对

Answer 2

String r1="insert into person values("+"'s1','s2','s3','s4','s5','s6','s7','s8')";
应改为
String r1="insert into person values('"+s1+"','"+s2+"','"+s3+"','"+s4+"','"+s5+"','+s6+"','"+s7+"','+s8+"')";

Answer 3

所以我们要尽量用PreparedStatement 而不是Statement