在MySQL查询Java中使用撇号

Question

so I have run into a bit of an Issue with MySQL. I have a service that allows administrators to ban users, and give a reason for their banning. This service is written fully in java... while I could use a PhP server and use the MySQL functionality in that to solve this... I feel I want to keep all of my MySQL functionality in one enviroment.

The issue comes about with the ability to give a reason, often an admin will give a reason something along the lines of "You're banned for: Griefing Bob's castle" (or something of the sort). As noticed, the ' ' cause problems, because those are used to represent Strings in MySQL.

Are there any solutions in a Java environment?

Answer 1

The easiest solution might be Commons Lang StringEscapeUtils.escapeSql(String) . Another solution is to use a PreparedStatement and to bind the parameters (some prefer this second option because it usually scales better and has faster performance).

// From the JavaDoc on PreparedStatement
PreparedStatement pstmt = con.prepareStatement("UPDATE EMPLOYEES "
                                 + "SET SALARY = ? WHERE ID = ?");
pstmt.setBigDecimal(1, 153833.00)
pstmt.setInt(2, 110592)