从Java中的字符串中删除特定字符

Question

I have the following query:

select *from activo where id_oficina in(22,23) and id categoría = 'in(1,2)'

How can I remove the "=" character and the single quotes?

I'm working with kendo Ui and I did not know what can be removed manually.

Answer 1

Know nothing of Kendo, but it appears that you're trying to enter 'in(1,2)' in a field and then have that substituted into the query statement, instead of just entering a single value.

First off, should be using JDBC bind variables, somehow, any SQL statement created by doing string concatenation is ripe with security holes. https://www.owasp.org/index.php/Top_10_2013-A1-Injection

Second, you can't bind values for an IN the same way as a single value. Now, you could always have an IN clause and sometimes you'll bind just a single value. This has been addressed before: How do I bind an ArrayList to a PreparedStatement in Oracle?

Answer 2

The replaceAll suggested by @Andy Turner works:

String string = "select *from activo where id_oficina in(22,23) and id categoría = 'in(1,2)'";
string = string.replaceAll("[=']", "");
System.out.println(string);