HQL：处理特殊字符

Question

I am trying to fetch value from database using HQL but am getting exceptions because value contains special characters. I am not able to figure out why.

Below is the code i am trying:

    HotelMapping hotelMapping = null;
    SessionFactory sessionFactory = HibernateUtil.getSessionFactory();
    Session session = sessionFactory.openSession();

    Transaction tx = session.getTransaction();
    tx.begin();
    String hotelName = "A Fisher's Inn Motel";
    Query query = session.createQuery("from HotelMapping hm where hm.hotelID.hotelName='"+hotelName+"'");
    HotelMapping mapping = query.uniqueResult();
    }
    tx.rollback();

    sessionFactory.close();

The pojos look like below: Hotel.java

public class Hotel{
    String hotelName;
    double price;
    //getters and setters
}

HotelMapping.java

public class HotelMapping{

     @OneToOne(cascade = CascadeType.ALL)
     Hotel hoteID

     String location;
}

The query string

Query query = session.createQuery("from HotelMapping hm where hm.hotelID.hotelName='"+hotelName+"'"); gives me below exception :

Exception in thread "main" org.hibernate.QueryException: expecting ''', found '<EOF>' [from com.pb.model.HotelMapping hm where hm.hotelID.hotelName='A Fisher's Inn Motel']

I tried escaping the apostrophe but with no luck. I ven tried setting the query parameter but again i got exception

query.setParameter("hotelName", "A Fisher's Inn Motel");

It says Exception in thread "main" org.hibernate.QueryParameterException: could not locate named parameter [hotelName]

Please if someone could help me achieving a generalized solution for the special character handling?

Answer 1

You should never use concatenation to pass dynamic parameters like this. This is not only not efficient, but also not robust (since a single quote in the parameter value makes the query invalid) and insecure, since a malicious user could pass a value that changes the semantics of the query (google for "SQL injection attack").

Instead, use parameters:

Query query = session.createQuery(
    "from HotelMapping hm where hm.hotelID.hotelName = :hotelName");
query.setString("hotelName", hotelName);