30

I am building an insert command to execute using jdbc. Part of it is to concatenate a user generated string...this all works until the user uses a string like this:

a'bcd

String userString="a'bcd";
String insertTableSQL = "INSERT INTO myTable "
                            + "(insertColumn) " 
                            + "VALUES("
                                +"'"+userString+"'"
                                +")";

statement.executeUpdate(insertTableSQL);
2

3 Answers 3

64

You can do either of the below:

  1. Use the PreparedStatement class. (Recommended)

    String userString="a'bcd";
    String myStatement = " INSERT INTO MYTABLE (INSERTCOLUMN) VALUES (?)";
    PreparedStatement statement= con.prepareStatement   (myStatement );
    statement.setString(1,userString);
    statement.executeUpdate();
    
  2. Escape the single quotes.

    In SQL, single quotes will be escaped by using double single quotes. ' --> ''

    String userString="a'bcd";
    String changedUserString = userString.replace("'","''");
            //changedUserString  = a''bcd
    String insertTableSQL = "INSERT INTO myTable (insertColumn) VALUES("
                            +" '"+changedUserString +"' )";
    
0
8

You can use StringEscapeUtils from the Apache Commons Lang library. Using this you can escape characters from html, xml, sql, etc. Look for method escapeXXX for your purpose. For reference: When i need to escape Html string?

note: escapeSql was removed in Apache Commons Lang 3 (see Migrating StringEscapeUtils.escapeSql from commons.lang which references https://commons.apache.org/proper/commons-lang/article3_0.html#StringEscapeUtils.escapeSql)

Eg:

String str = FileUtils.readFileToString(new File("input.txt"));
        String results = StringEscapeUtils.escapeHtml(str);
        System.out.println(results);

Input:

<sometext>
Here is some "Text" that I'd like to be "escaped" for HTML
& here is some Swedish: Tack. Vars?god.
</sometext>

Output:

&lt;sometext&gt;
Here is some &quot;Text&quot; that I'd like to be &quot;escaped&quot; for HTML
&amp; here is some Swedish: Tack. Vars&aring;god.
&lt;/sometext&gt;
3
  • 3
    In StringEscapeUtils documentationfor for escapeSQL: "At present, this method only turns single-quotes into doubled single-quotes"
    – potapuff
    Nov 13, 2015 at 15:34
  • 5
    StringEscapeUtils.escapeSql is depreciated.
    – chancyWu
    Jan 12, 2017 at 5:42
  • 1
    This approach only works if you intend to use the input as a HTML output later on. About deprecation, v3.6 of commons-lang is still there and works fine with org.apache.commons.text.StringEscapeUtils.
    – Alfabravo
    Jun 23, 2017 at 18:09
1

Here's another option:

Use a native Android method designed for exactly this purpose:

DatabaseUtils.sqlEscapeString(String)

Here is the documentation for it online:

The main advantage of using this method, in my opinion, is the self-documentation because of the clear method name.


String userString="a'bcd";
String insertTableSQL = "INSERT INTO myTable "
                            + "(insertColumn) " 
                            + "VALUES("
                                +"'"+DatabaseUtils.sqlEscapeString(userString)+"'"
                                +")";

statement.executeUpdate(insertTableSQL);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.