Is there a standard function for making a string into an sql friendly string in Java? [duplicate]

Question

Possible Duplicate:
Java - escape string to prevent SQL injection

Hi.

I constantly am running into silly little issues with submitting an sql query to my database when the sql query includes a user written string (including random characters like '$%&).

Is there a standard function anywhere that converts the user text into sql friendly text for Java?

Thx

Possible duplicate of a previously asked question, please see: stackoverflow.com/questions/1812891/… — Andre
– Andre, Commented Dec 25, 2010 at 15:33

Etienne de Martel · Accepted Answer · 2010-12-25 15:50:29Z

7

The following advice is good for any language or framework: do not write your queries by concatenating strings, that's unsafe. Use parameterized queries instead.

In Java, parameterized queries are written with PreparedStatement. For instance:

PreparedStatement stmt = connection.prepareStatement("SELECT * FROM whatever WHERE id = ? AND name= ?");
stmt.setInt(1, 1000); // parameters starts at 1
stmt.setString(2, "'$%&");
ResultSet rs = stmt.executeQuery();
// ...

More details there: http://download.oracle.com/javase/tutorial/jdbc/basics/prepared.html

See also the documentation for PreparedStatement: http://download.oracle.com/javase/1.4.2/docs/api/java/sql/PreparedStatement.html

answered Dec 25, 2010 at 15:50

Etienne de Martel

37.2k10 gold badges95 silver badges119 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Is there a standard function for making a string into an sql friendly string in Java? [duplicate]

1 Answer 1

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Linked

Related