ResultSet返回PreparedStatement参数而不是实际结果[duplicate]

Question

我想从一个MariaDB数据库获取数据，并通过Maven安装了MariaDB JDBC连接器。下面的代码将PreparedStatementPSTMT数据的参数而不是实际的行/单元格数据添加到组合框中（请参见代码段，第10行）。这就是我要解决的问题。如果重要的话，我的表由1个int和4个varchar组成。

代码段（带行计数）：

// WRITTEN IN NORMAL JAVA 11
 1| Connection db = DriverManager.getConnection("jdbc:mariadb://localhost:3306/DB", "USER", "PASSWORD");
 2| PreparedStatement pstmt = db.prepareStatement("SELECT ? FROM companies;");
 3| pstmt.setString(1, ((JComboItem) companySelectFilterCategoryComboBox.getSelectedItem()).getValue()); // getValue() returns "email"; Combo Box is JComboBox<ComboItem>, ComboItem.groovy is below
 4| System.out.println(pstmt); // OUTPUT: sql : 'SELECT ? from companies;', parameters : ['email']
 5| ResultSet rs = pstmt.executeQuery();
 6| ArrayList<ArrayList<String>> list = ResultSetService.resultSetToArrayLists(rs); // This returns an ResultSet as an deep ArrayList (as ArrayList<ArrayList<String>>), see below
 7| System.out.println(ResultSetService.toString(rs)); //OUTPUT: [[email], [email]]

// This output is already wrong, should be: [[mail1@localhost], [mail2@localhost]]
// This is the above mentioned problem I want to fix.

 8| companySelectOptionsComboBox.removeAllItems();
 9| for (ArrayList<String> arr: list) {
10|    companySelectOptionsComboBox.addItem(arr.get(0));
11| }

// WRITTEN IN GROOVY
class JComboItem {
    private String key;
    private String value;

    JComboItem(String key, String value)
    {
        this.key = key;
        this.value = value;
    }

    @Override
    String toString()
    {
        return key;
    }

    String getValue()
    {
        return value;
    }
}

// WRITTEN IN GROOVY
class ResultSetService {

    static ArrayList<ArrayList<String>> resultSetToArrayLists(ResultSet rs) throws SQLException {
        ArrayList<ArrayList<String>> list = new ArrayList<>()
        rs.beforeFirst()
        while (rs.next()) {
            ArrayList<String> row = new ArrayList<>()
            for (int i = 1; i <= rs.getMetaData().getColumnCount(); i++) {
                row.add(rs.getString(i))
            }
            list.add(row)
        }
        return list
    }
}

Answer 1

不能使用占位符插入列名。有效的查询是:选择'email'from something。您必须将列的名称连接到sql字符串中。因此，要加倍小心，恶意用户不能在那里注入sql（例如，使用枚举或其他允许列表）。