title: Prepared Statements from text fields in java
body: <p>Sorry to sound stupid.. but i am wanting to create a prepared statement to get rid of the injection in my java project. The problem is that i don't seem to understand how to convert int into String from the text box data and use it in the statement. i have been researching for hours but got nothing! this is my Injected code:</p>
  
  <pre><code> this.sql_Query = "update customer set cust_id ='" + 
       String.valueOf(txtcust_id.getText()) + ",'" + txtcust_name.getText() +
       "','" + txtf_name.getText() + "','" + txtb_date.getText() + "' , '" +
       txtcnic.getText() + "','" + txtcity.getText() + "','" +
       txtcard_num.getText() + "',,'" + txtacc_num.getText() + "',,'" +
       txtb_n.getText() + "',,'" + txtadd.getText() + "',,'" +
       txtemail.getText() + "','" + txtph_num.getText() + "' )";
  </code></pre>
  
  <p>and this is what i have converted this into: </p>
  
  <pre><code>String query = "INSERT INTO customers( cust_id , cust_name , father_name, birth_date, CNIC," 
              city, card_num, acc_num, bank_name, address , email, ph_num ) values (?,?,?,?,?,?,?,?,?,?,?,?);
              pst = conn.prepareStatement(query); // create a statement
              pst.setInt(1, cust_id); // set input parameter 1
              pst.setString(2, "cust_name"); // set input parameter 2
              pst.setString(3, "father_name"); // set input parameter 3
              pst.setDate(4, birth_date );
              pst.setBigint(5, CNIC);
              pst.setString(6, "city");
              pst.setBigint(7, card_num);
              pst.setBigint(8, acc_num);
              pst.setString(9, "bank_name");
              pst.setString(10, "address");
              pst.setString(11, "email");
              pst.setBigint(12, ph_num);
              pstmt.executeUpdate();
  </code></pre>
  
  <p>I can't understand how to deal with the integer type stuff in here.
  I would appreciate all the help i can get as this is making me so frustrated.</p>