45

I want to perform a query like the following:

uvalue = EditText( some user value );
p_query = "select * from mytable where name_field = '" +  uvalue + "'" ;
mDb.rawQuery( p_query, null );

if the user enters a single quote in their input it crashes. If you change it to:

p_query = "select * from mytable where name_field = \"" +  uvalue + "\"" ;

it crashes if the user enters a double quote in their input. and of course they could always enter both single and double quotes.

2

6 Answers 6

130

You should make use of the rawQuery method's selectionArgs parameter:

p_query = "select * from mytable where name_field = ?";
mDb.rawQuery(p_query, new String[] { uvalue });

This not only solves your quotes problem but also mitigates SQL Injection.

6
  • 6
    I wish I could upmod this more than once!
    – jrockway
    Aug 18, 2009 at 20:52
  • 1
    It is also much faster because Sqlite doesn't have to parse every sql statement.
    – tuinstoel
    Aug 19, 2009 at 20:33
  • 20
    Indeed, you should use query arguments. However, you can also use the DatabaseUtils to escape strings, if needed. For instance, DatabaseUtils.sqlEscapeString(). It's not the best way, but it's available. Could be useful if you're trying to pass a raw SQL statement over to something external.
    – lilbyrdie
    Aug 22, 2009 at 15:50
  • 1
    @lilbyrdie: thanks! As one can't bind vectors of strings for use with the IN operator, sqlEscapeSting() was just what I needed! Jan 13, 2011 at 22:33
  • This doesn't work as well as you'd think. If you use a string like this it breaks: "sample " string ' that breaks stuff" Aug 24, 2012 at 3:20
14

DatabaseUtils.sqlEscapeString worked properly for me. The string is enclosed by single quotes and the single quotes inside the string become double quotes. Tried using selectionArgs in the getContentResolver().query() but it didn't work at all.

1
  • The DatabaseUtils.sqlEscapeString replaces one or two special characters where the need is to replace all special characters, isn't there any way to replace specified or all special characters?
    – blueware
    Mar 25, 2019 at 12:33
5

You should change

p_query = "select * from mytable where name_field = '" +  uvalue + "'" ;

like

p_query = "select * from mytable where name_field = '" + android.database.DatabaseUtils.sqlEscapeString(uvalue)+ "'" ;
1
  • 2
    but your need remove quotes because they are added by default
    – Vlad
    Jan 14, 2018 at 11:23
3

Have you tried replacing a single quote with 2 single quotes? That works for inputting data to a database.

1
  • I would prefer to use the top answer, but in my case it was not possible do to application design. This works too Feb 27, 2012 at 17:42
3

I prefer to escape Single quotes and Double quotes in each insert statement with Sqlite like this:

 String sqlite_stament = sqlite_stament.replace("'", "''").replace("\"", "\"\"");
0

I have same problem but now it is solved by just writing the code like in your case you want to insert value uvalue .Then write as

uvalue= EditText( some user value );
uvalue = uvalue.replaceAll("'", "''");
p_query = "select * from mytable where name_field = '" +  uvalue + "'" ;
mDb.rawQuery( p_query, null );

cool..!!

2
  • 2
    that's stupid, you're replacing ' with '' which will still causes issues. Jul 19, 2013 at 10:34
  • @stealthcopter That's not stupid, the standard SQL way of escaping a single quote in a string literal is to double it so '''' is an SQL string literal which contains one single quote. Manually escaping strings for SQL may not be the best idea but the result is correct in this case. Dec 16, 2017 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.