sql - How to solve unknown column in where clause

Question

I have one problem with method getByLogin :

@Override
    public User getUserByLogin(String username) {
        Session  session = this.sessionFactory.openSession();
        User user =
                (User) session.createQuery("FROM pl.edu.wszib.model.User WHERE username = " + username ).uniqueResult();
        session.close();
        System.out.println(user);
        return user;

    }

i want to get user by username by i got : com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Unknown column 'konrad' in 'where clause'

My form look like :

 <form action="/user"  th:object="${user}" method="post" id="login" class="input-group">
                <input type="text" class="input-field" placeholder="username" name="username" th:field="*{username}" th:errorClass="error"required>
                <span th:if="${#fields.hasErrors('username')}" th:errors="*{username}">Incorrect data</span>

                <button type="submit" class="submit-btn">Get your  profil</button>
            </form>

and my controller look that :

@RequestMapping("/user")
    public String user(Model model, User user, BindingResult bindingResult){
        if(bindingResult.hasErrors()) {
            return "user"; // powrót do formularza
       }
        User result =  userDAO.getUserByLogin(user.getUsername());
        model.addAttribute("result", result);
        return "resultUser";

    }

    @GetMapping("/user")
    public String userForm(User user) {
        return "user";
    }

but i have second method get by id which work good and i got user by id this method this metod look that:

 @Override
    public User getUserById(int idUser) {
        Session  session = this.sessionFactory.openSession();
        User user =
                (User) session.createQuery("FROM pl.edu.wszib.model.User WHERE idUser = " + idUser ).uniqueResult();
        session.close();
        System.out.println(user);
        return user;

    }

I have to users in my database and one user have username konrad but this method cant work. Can someone explain why metod getBylogin dont work ?

Answer 1

The unknown column is related to the missing quote around a string, so the string content is evaluated as a column name.

You can avoid this using parameter binding:

    session.createQuery("FROM pl.edu.wszib.model.User WHERE username = :username" )
    .setParameter("username", username)
    .uniqueResult();