Escaping a single quote when using JdbcTemplate

问题

We're using JdbcTemplate to modify our underlying Oracle database. We're doing this by way of the update(String sql) method.

The code looks somehow like the following:

String name = "My name's yellow";
String sql = "update FIELD set NAME = '" + name "' where ID = 10
jdbcTemplate.update(sql);

This causes the error:

java.sql.SQLException: ORA-00933: SQL command not properly ended

The problem is the unescaped ' in the name variable.

What's the most convenient and correct way to escape this character?

回答1:

Use PreparedStatement. That way you nominate a placeholder and the JDBC driver will perform this correctly by sending the database the statement, plus the parameters as arguments.

    String updateStatement =
    "update " + dbName + ".COFFEES " +
    "set TOTAL = TOTAL + ? " +
    "where COF_NAME = ?";

    PreparedStatement updateTotal = con.prepareStatement(updateStatement);
    updateTotal.setInt(1, e.getValue().intValue());
    updateTotal.setString(2, e.getKey());

The question marks in the above represent the placeholders.

Because these values get passed as parameters, you don't have problems with quoting, and it protects you against SQL injection too.

回答2:

Try for name :

if ( name.contains("'") ){
    name.replaceAll("'", "''");
}

来源：https://stackoverflow.com/questions/11956451/escaping-a-single-quote-when-using-jdbctemplate