title: SQL Injection fixed but query is not working -Spring MVC
body: <p>I fixed Sql injection in IF section and because the number of parameter is different in IF and ELSE sections,I break down IF..ELSE into two function but unfortunately My queries not work is anybody have suggestion Please?  </p>
  
  <pre><code> if (prevContactSeq==null)
      {
  
          contactQuery.append("Insert into contacttable(");
          contactQuery.append("ContactSeq,ID,LastName,FirstName,ContactLabel,Phone1,Phone2)");
          contactQuery.append("Values("+ contactSeq+ "," + Id + ",'" + lastName + "','"+ firstName + "','WEB',"+ Long.parseLong(contactresult) + ","+ Long.parseLong(alternatecontactresult) + ")");
          //+ updateFields + " where id = " + tId;
          logClient.debug("Insert Query " + contactQuery.toString()); 
          System.out.println("RContact Insertion Query "+contactQuery.toString());
      }
      else
      {
  
  
          contactQuery.append("Update contacttable ");
          contactQuery.append(" Set phone1=" + Long.parseLong(contactresult) + ",");
          contactQuery.append(" phone2 =" + Long.parseLong(alternatecontactresult));
          contactQuery.append(" Where contactSeq="+ prevContactSeq);
          contactQuery.append(" And id=" + Id);
  
          System.out.println("Contact Update Query "+contactQuery.toString());
      }
  
      try{        
          JdbcTemplate jdbcTemplate = this.getJdbcTemplate();         
          return jdbcTemplate.update(contactQuery.toString());
      }catch(DataAccessException dae){
          dae.printStackTrace();
          //error in making the database update. return 0 to identify that the     database update failed
          return 0;
      }
  } 
  </code></pre>
  
  <p>I do this fixes but queries are not working  :</p>
  
  <pre><code>if (prevContactSeq == null) {
  
  
  
          update= insertContact(firstName,Id, contactresult,
                  alternatecontactresult, contactSeq,lastName);
      }
      else
      {
  
  
          update= updateContact(Id, contactresult,
                  alternatecontactresult, prevContactSeq);
      }
      return update;
  
  
  
  }
  
  private int updateContact(int Id,
          String contactresult, String alternatecontactresult,
          Integer prevContactSeq) {
  
      StringBuffer contactQuery =new StringBuffer();
      contactQuery.append("Update contacttable ");
      contactQuery.append(" Set phone1=Long.parseLong(?),");
      contactQuery.append(" phone2 =Long.parseLong(?)");
      contactQuery.append(" Where contactSeq=?");
      contactQuery.append(" And id=?");
  
      System.out.println("Contact Update Query "+contactQuery.toString());
      try{        
          JdbcTemplate jdbcTemplate = this.getJdbcTemplate();         
          return jdbcTemplate.update(contactQuery.toString(),  new Object[] {contactresult,alternatecontactresult,prevContactSeq,Id});
      }catch(DataAccessException dae){
          dae.printStackTrace();
          //error in making the database update. return 0 to identify that the database update failed
          return 0;
  }
  }
  
  private int insertContact(String firstName, int Id,
          String contactresult, String alternatecontactresult,
          Integer contactSeq,String lastName) {
      StringBuffer contactQuery =new StringBuffer();
      contactQuery.append("Insert into contacttable(");
      contactQuery.append("ContactSeq,ID,LastName,FirstName,ContactLabel,Phone1,Phone2)");
      contactQuery.append("Values( ?,?,?,?,?,Long.parseLong(?),Long.parseLong(?)");
      logClient.debug("Insert Query " + contactQuery.toString()); 
      System.out.println("Contact Insertion Query "+contactQuery.toString());
      try{        
          JdbcTemplate jdbcTemplate = this.getJdbcTemplate();         
          return jdbcTemplate.update(contactQuery.toString(),  new Object[] {contactSeq,Id,lastName,firstName,"WEB",contactresult,alternatecontactresult});
      }catch(DataAccessException dae){
          dae.printStackTrace();
          //error in making the database update. return 0 to identify that the database update failed
          return 0;
  }
  }
  </code></pre>