在JDBC中转义单引号（出现错误：SQL语法中有错误……）

Question

I'm trying to insert data into mysql using jdbc. I have something like this:

    Connection conn = DriverManager.getConnection(urlDB, userDB, passwordDB);

    String postTitle = "Post title";
    String postContent = "A Linux's distributions";

    String sql = "INSERT INTO posts VALUES ( '"+postTitle+"', '"+postContent+"')";          
    PreparedStatement statement = conn.prepareStatement(sql);
    statement.executeUpdate();
    conn.close();

But I'm getting an error:

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's

As far as I know the prepareStatement method should escape single quotes (Мaybe I'm wrong). I'll be glad for any suggestions.

Answer 1

To use prepared statements correctly, you need to use parameter placeholders ( ? ) and set the values on the statement. This will automatically give you protection against SQL injection.

You need to change your code to:

String sql = "INSERT INTO posts VALUES (?, ?)";          
try (PreparedStatement statement = conn.prepareStatement(sql)) {
    statement.setString(1, postTitle);
    statement.setString(2, postContent);
    statement.executeUpdate();
}

See also JDBC Basics - Using Prepared Statements for examples of how to use PreparedStatement .

I have also changed your code to use try-with-resources, as this will always close the statement correctly (even if an exception occurs), which the code in your question does not.

Note that it would be better if you explicitly specify the columns you are inserting to. This protects your code against columns changing order or new - optional - columns added:

INSERT INTO posts(title, content) VALUES (?, ?)

Answer 2

You shouldn't use concatenation for inserting parameter values in a SQL query. Use question marks and set* methods. This will ensure escaping.

PreparedStatement pstmt = con.prepareStatement("UPDATE EMPLOYEES SET SALARY = ? WHERE ID = ?");
pstmt.setBigDecimal(1, 153833.00)
pstmt.setInt(2, 110592)

See the docs: https://docs.oracle.com/javase/8/docs/api/java/sql/PreparedStatement.html

Answer 3

replace

String sql = "INSERT INTO posts VALUES ( '"+postTitle+"', '"+postContent+"')";

with

String sql = "INSERT INTO posts VALUES ( '"+postTitle.replace("'","''")+"', '"+postContent.replace("'","''")+"')";