cant find the error in the following SQL statemen but it just wont work!!

[nmvictor]

I have the following codein my project.My IDE(netbeans) points out an error in the

executeUpdate

statement which I cant spot.Anyone willing to proof read and point out the error?

//All unseen variablesdeclaration and constructors were declared above^^^
public void registerNewStudent()
    {
        String fname=newStudent.getFirstName();
        String lname = newStudent.getLastName();
        String regNumber = newStudent.getKURegNumber();
        String campus = newStudent.getCampus();
        String nationalID = newStudent.getNational_ID();
        String courseCode,
                studentID,
                yearOfEntry;
        String str = regNumber;
        String split [];
        split = str.split("/");
      
        courseCode = split[0];
        studentID = split[1];
        yearOfEntry = split[2];

        Connection con = null;
        try {
            Class.forName(DRIVER).newInstance();
            Properties p = new Properties();
            p.put("user", "root");
            p.put("password", "mysecret");
            con = DriverManager.getConnection(DATABASE_URL,p);
            Statement stmt = con.createStatement();
            stmt.executeUpdate("INSERT into kustudents (StudentID, FirstName, 
         // ^^^^^^^everything in the project is fine until here ^^^^:confused:
LastName, CourseCode, YearOfEntry, RegNumber, National_ID, Campus) " +
                                             "VALUES ("+studentID+",'"+fname+"','"+lname+"','"+courseCode+"','"+yearOfEntry+"','" +regNumber+"','" +nationalID+"','"+campus+"')");
  //I have a feeling I messed up with the above.
            stmt.close();
            System.out.print("Thank you for registering..");
        }
//all the rest proceeds:p

[r035198x]

Don't create queries by concatenating strings like that.
Use a PreparedStatement instead.

[RamyaSivakanth]

Like what ro35198x said ,u have to use PreparedStatement for this things.

Another suggestion,u should not directly give big query statement for execution.debugging will be a problem.Use StringBuffer for framing query and then use toString() method for stringbuffer object and use it in executeupdate().Before passing just put s.o.p for seeing ur query and u can easily correct if something goes wrong.

[nmvictor]

Thanks for all who've help me through this thread.