如何实现JSP页面间多参数传递并在SQL查询中设置多参数值

Hey Vijay, let's break this down step by step so you can safely pass parameters between your JSP pages and use them in your SQL query without running into security headaches like SQL injection.

You’ve got two common, reliable ways to send parameters to the second page:

Using URL Parameters (GET Method) #

Great for non-sensitive data—just append parameters to the URL of your second JSP. You can do this with a hyperlink or server-side redirection:

<!-- First JSP: Hyperlink with parameters -->
<a href="second.jsp?productId=123&category=electronics&status=active">View Results</a>

<!-- Or server-side redirection (if you need to compute values first) -->
<%
    String productId = "123";
    String category = "electronics";
    response.sendRedirect("second.jsp?productId=" + productId + "&category=" + category);
%>

Note: GET parameters show up in the browser’s URL, so don’t use this for passwords or sensitive info.

Using Form Submission (POST Method) #

Better for sensitive data—parameters are sent in the request body instead of the URL:

<!-- First JSP: HTML form -->
<form action="second.jsp" method="post">
    <input type="hidden" name="productId" value="123">
    <input type="text" name="category" placeholder="Enter category">
    <select name="status">
        <option value="active">Active</option>
        <option value="inactive">Inactive</option>
    </select>
    <button type="submit">Fetch Data</button>
</form>

Once the parameters reach the second page, use request.getParameter() to grab them. Always handle null values to avoid runtime errors:

<%
    // Retrieve individual parameters
    String productId = request.getParameter("productId");
    String category = request.getParameter("category");
    String status = request.getParameter("status");

    // Set default values if parameters are missing
    productId = (productId == null) ? "" : productId;
    category = (category == null) ? "" : category;
%>

If you’re dealing with multi-value inputs (like checkboxes), use request.getParameterValues() to get an array:

String[] selectedTags = request.getParameterValues("tags");

Never, ever directly concatenate parameters into your SQL string—this is a massive security hole that lets attackers manipulate your database. Instead, use PreparedStatement to safely bind parameters:

<%
    try {
        // Load your JDBC driver (adjust for your database: MySQL, Oracle, etc.)
        Class.forName("com.mysql.cj.jdbc.Driver");
        // Establish database connection (replace with your credentials)
        Connection conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/your_db", "db_user", "db_password");

        // Write SQL with placeholders (?) instead of direct values
        String sql = "SELECT * FROM products WHERE id = ? AND category = ? AND status = ?";
        PreparedStatement pstmt = conn.prepareStatement(sql);

        // Bind parameters to the placeholders (index starts at 1)
        pstmt.setString(1, productId);
        pstmt.setString(2, category);
        pstmt.setString(3, status);

        // Execute the query and process results
        ResultSet rs = pstmt.executeQuery();
        while (rs.next()) {
            // Fetch data from the result set
            String productName = rs.getString("product_name");
            double price = rs.getDouble("price");
            out.println("<p>" + productName + " - $" + price + "</p>");
        }

        // Clean up resources to prevent leaks
        rs.close();
        pstmt.close();
        conn.close();
    } catch (Exception e) {
        // Log the error internally (don't show stack trace to users!)
        e.printStackTrace();
        out.println("<p>Oops, something went wrong. Please try again later.</p>");
    }
%>

If your parameter is a number (like productId), use the appropriate type method instead of setString():

int id = Integer.parseInt(productId);
pstmt.setInt(1, id);

• Use JSTL/EL instead of scriptlets: Scriptlets (<% %>) make code messy. Use Expression Language to access parameters cleanly: ${param.productId}
• Validate input: Always check if parameters are valid (e.g., ensure productId is a number, trim whitespace from strings) before using them in queries.
• Use connection pools: Instead of creating a new connection every time, use a connection pool (like Apache DBCP) for better performance.

内容的提问来源于stack exchange，提问作者vijayGowda