How to insert a string that contains ' or ,

macit wrote in
b9d4eaabffe8.DeleteThis@q21g2000hsa.googlegroups.com:

> Hello,
>
> i am using the following statement to insert a message from a user
> into the database.
>
> updStmt.executeUpdate("INSERT INTO Contact (uId, replyAddr, subject,
> msg) "+
> "VALUES (" + userId + "," +
> "\'" + replyAddr + "\'," +
> "\'" + subject + "\'," +
> "\'" + msg + "\')");
>
> The variables userId, replyAddr, subject und msg are of type String.
> Now if one of the Strings contain a ' or a , character, the sql
> statement gets messed up and causes a SqlException. Is there a way
> (How) can i store a string that contains ' or , in the database?
> Thanks in advance for your assistance.
>

Yes. First google "sql injection" and learn that bad guys can own you and
your system with the code you provided.

You can use PreparedStatement like

PreparedStatement pstmt = con.prepareStatement("UPDATE EMPLOYEES
SET SALARY = ? WHERE ID = ?");
pstmt.setBigDecimal(1, 153833.00)
pstmt.setInt(2, 110592)


You create statemets with placeholders (?), and bind variables ot values to
those placeholders. That way the variables CAN hold ` or , characters, and
they do not spoil the SQL statement.

If I ever see a SQL implementation what you showed, I will sack the
programmer.. Well maybe not, but I will lower his salary, and try to tell
him about "sql injection".

Never, never, EVER, do not ever build SQL statements dynamically with
variables like that.

ALWAYS use ? placeholders. That is a pivilege to you as a java-programmer.
Leave the SQL-injection to those pesky php-guys.
 >> Stay informed about: How to insert a string that contains ' or , 

Donkey Hot wrote:
> ALWAYS use ? placeholders. That is a pivilege to you as a java-programmer.
> Leave the SQL-injection to those pesky php-guys.

Or tell them to read
http://www.php.net/manual/en/function.mysqli-prepare.php !

Arne
 >> Stay informed about: How to insert a string that contains ' or ,