连接查询字符串时出现SQL语法错误

错误消息显示：

0957936101205'AND strike_status = 'ACTIVE'第1行的' '附近

它实际上是在标识0后面的'，该结尾以第一行开头的文本文字，因为这是错误的SQL：

SELECT MAX(strike_id) FROM strike WHERE '...'0957936101205'AND strike_status = 'ACTIVE'
--                                          ^^ BAD

这是带有注释的代码：

try(Connection dbConnection = DBConnectionManager.getIntakeConnection();
PreparedStatement preparedStmtSetMaxStrikeId = dbConnection.prepareStatement(
      "SELECT MAX(strike_id) FROM strike WHERE 'SELECT p.party_type_id,"
//                                             ^ What is this? Even without ' it makes no sense
//                                             ^ But it STARTS A TEXT LITERAL
    + "p.csa_score,p.party_tn,p.rec_create_date,"
    + "s.strike_id, s.strike_date, s.strike_level, s.strike_status, s.appealable,s.appeal_status,s.rec_change_date,s.event_id,s.is_email_processed,s.policy_id"
    + "FROM strike s "
//     ^ Missing space, but it's in a text literal so doesn't matter
    + "INNER JOIN parties p"
    + "ON p.party_id = s.party_id"
//     ^ Missing space, but it's in a text literal so doesn't matter
    + "WHERE p.account ='"+appealStatus.getSubscriberId()
//     ^ Missing space, but it's in a text literal so doesn't matter
//                      ^ END TEXT LITERAL from first line
//                         ^ error complains about inserted value 0957936101205
    +"'AND strike_status = '"+OCIRISConstants.STRIKE_STATUS_ACTIVE+"' ");)
//    ^ Starts a new text literal
//     ^ Missing space, but it's in a text literal so doesn't matter
//                         ^ end text literal
//                            ^ would complain about inserted value ACTIVE
//                                                                  ^ Dangling '

同样，您不应该使用字符串连接来构建SQL，因为它会导致语法错误，并使您容易受到SQL Injection攻击，从而使黑客能够窃取您的数据并删除表。

假设姓名缩写有SELECT MAX( ... WHERE '误，以下是一个经过清理的版本，为清楚起见，其格式如下：

String sql = "SELECT p.party_type_id, p.csa_score, p.party_tn, p.rec_create_date" +
                  ", s.strike_id, s.strike_date, s.strike_level, s.strike_status" +
                  ", s.appealable, s.appeal_status, s.rec_change_date, s.event_id" +
                  ", s.is_email_processed, s.policy_id" +
              " FROM strike s" +
             " INNER JOIN parties p ON p.party_id = s.party_id" +
             " WHERE p.account = ?" +
               " AND strike_status = ?";
try (Connection conn = DBConnectionManager.getIntakeConnection();
     PreparedStatement stmt = conn.prepareStatement(sql)) {
    stmt.setString(1, appealStatus.getSubscriberId());
    stmt.setString(2, OCIRISConstants.STRIKE_STATUS_ACTIVE);