Apostrophe in SQLite select query

问题

I have a problem with SQLite and a bit of bespoke SQL:

public Cursor getExistingSpeciesDetails(String sub_id, String english_name) {
    Cursor c = mDb.rawQuery(
            "SELECT mobileobs.how_many, mobileobs.comment, mobileobs.sensitive, "
                    + "mobileobs.breeding_evidence from mobileobs "
                    + "WHERE mobileobs.sub_id = '" + sub_id
                    + "' and mobileobs.english_name = '" + english_name
                    + "'", null);
    return c;
}

My problem is an apostrophe in the english name (Cetti's Warbler) is causing an error in the SQL (force closing my Android app). Is there any way to escape the apostrophe in this type of clause?

Thanks in advance

回答1:

For that purpose you need to use SQLIte's parameter injections. For example:

Cursor c = mDb.rawQuery(
            "SELECT mobileobs.how_many, mobileobs.comment, mobileobs.sensitive, "
             + "mobileobs.breeding_evidence from mobileobs "
             + "WHERE mobileobs.sub_id = ? AND mobileobs.english_name = ?"
             , new String[]{sub_id, english_name});

Or change your input parameter as below:

Cetti''s Warbler

来源：https://stackoverflow.com/questions/12561173/apostrophe-in-sqlite-select-query