how to create a new syntax in java?

Syntax error trying to create an sql table from Java

• I want to create a table and this table's name will be inserted from a textfield. However when I run the query it's giving me an error, any help on this one? I'll paste the code here: public boolean CreateTable() { TableNumber = jTextField4.getText(); try { String password = null; String s = "CREATE TABLE '"+TableNumber+ "' (Item char(50),Price char(50))"; ConnectionForOrders(); stmt = conn.createStatement(); stmt.executeUpdate(s); boolean f = false; ConnectionForOrdersclose();

• Answer:

  I'll start by assuming your '" gaff is a typo because it shouldn't even compile that way (I edited the question to fix it for those that come later). That aside, you don't enclose tables names in single quotes. It's not: CREATE TABLE 'tablename' ( ... ) You just write: CREATE TABLE tablename ( ... ) But you shouldn't even do that much, because you're getting your tablename from a text field. What's to prevent someone from entering something like this in that text field: a(b int);DROP TABLE users;-- (Assuming of course that you have a users table somewhere). It's important to remember that an attacker could enter any arbitrary sql after that first ;, and your database will blindly run it.