How to escape special characters like ' in sqlite in android

Question

I have a function which is executing a query on a table in SQLite database. I declare a constant: public static final String CANADA_HISTORY = "Canada's History";. This is stored in a String variable let's say difficulty,

I have one query:

Cursor c = mDb.rawQuery("select * from Questions_answers where CHAPTERS = '"+difficulty+"'" , null);

It is throwing an exception near the apostrophe.

Logcat output:

I/Database( 1170): sqlite returned: error code = 1, msg = near "s": syntax error
D/AndroidRuntime( 1170): Shutting down VM
W/dalvikvm( 1170): threadid=1: thread exiting with uncaught exception (group=0x40015560)
E/AndroidRuntime( 1170): FATAL EXCEPTION: main
E/AndroidRuntime( 1170): android.database.sqlite.SQLiteException: near "s": syntax error: , while compiling: select * from Questions_answers where CHAPTERS  = 'Canada's History'

I have also tried:

1.  difficulty=difficulty.replaceAll("'","''");
2.  difficulty=difficulty.replaceAll("'","\'");
3.  difficulty = DatabaseUtils.sqlEscapeString(difficulty);

To add to that, it's working me for the single words like Canada History, I mean without the special character word.

Please give me advice for the solve problem Thanks.

Answer 1

First replace char with this

difficulty=difficulty.replaceAll("'","\\'");

then pass it in your query

"select * from Questions_answers where CHAPTERS='"+difficulty+"'";

Edit :

 q = "select * from Questions_answers where CHAPTERS = ?";
    database.rawQuery(q, new String[] { difficulty});

Answer 2

The SQL standard specifies that single-quotes in strings are escaped by putting two single quotes in a row. SQL works like the Pascal programming language in the regard. SQLite follows this standard. Example:

INSERT INTO xyz VALUES('5 O''clock');

Ref : SQLite FAQ

Answer 3

The best way is to use a native Android method designed for exactly this purpose:

DatabaseUtils.sqlEscapeString(String)

Here is the documentation for it online:

• sqlEscapeString() on Android Developers

The main advantage of using this method, in my opinion, is the self-documentation because of the clear method name.

Answer 4

What worked for me was

if (columnvalue.contains("'")) {
    columnvalue = columnvalue.replaceAll("'", "''");
}

Answer 5

you can try Cursor c = mDb.rawQuery("select * from Questions_answers where CHAPTERS = \""+difficulty+"\"" , null);

Answer 6

This will work the same:

if (columnValue.contains("'")) 
    columnValue = columnValue.replaceAll("'", "[']");

or

if (columnValue.contains("'")) 
    columnValue = columnValue.replaceAll("'", "\\\'");

but in actuality we use next symbols % and _

Answer 7

What DatabaseUtils.sqlEscapeString(s) essentially does, is replace all single quotes (') with two single quotes ('') and append one single quote at the beginning and one at the end of the String.
So if you just want to escape the String this function should work:

private static String escape(String s) {
    return s != null ? s.replaceAll("\'", "\'\'") : null;
}

Answer 8

As per my understanding there are two approcaches,

String test= "Android's vaersion" test= test.replace("'","''");

This scenario is absolutely fine but i would definitely suggest to use following approach.

String test= "Android's vaersion" test= test.replaceAll("'","\'");

We faced the issue because of first approach when we were trying to update and select SQLite Table Value with '.

Answer 9

don't you need to escape the \ as well? so it would be replaceAll("'", "\\'") Or am I wrong about that?