Using a PreparedStatement to specify the column name and the new value

Question

I'm trying to make a query with a PreparedStatement like this:

UPDATE PLAYER SET ? = ? WHERE ID = ?

but I get

Error: java.sql.SQLSyntaxErrorException: ORA-01747

When I use code like this:

UPDATE PLAYER SET NAME = ? WHERE ID = ?

It works. However, I want to use 3 arguments in my method. Is that possible?

Why not just include logic in your Java code to determine which column to update? Or, better yet, craft the logic of your query to handle this. — Tim Biegeleisen
– Tim Biegeleisen, Commented Sep 12, 2016 at 13:36
Possible duplicate of PreparedStatement: Can I use the column name as parameter? — Gord Thompson
– Gord Thompson, Commented Sep 12, 2016 at 14:36

SantiG · Accepted Answer · 2016-09-12 13:46:49Z

This is not supported by PreparedStatement by itself

you can use string.replace but thats exactly what you should avoid when using preparedStatement (for sql injections)

if you are using Hibernate you can jump to Criteria and this would be very easy to do

1 Answer 1