Problem inserting a single quote (')

[Imran Ahmed Khan]

I am having this problem with JDBC ... Using INSERT INTO statement i want to insert a row in my database and the variables that contain data might contain a single quote (') within them ... whenever i use a single quote in any of the text feilds that are to be inserted in the database i get an error i.e Misssing Operator or something like that, without any quotes the statement is working correctly..........
So please if anyone can tell me how to insert a value in the database which contains a single quote(').... here is the code. I am using a class which has this function.

  
public boolean sendMail(String to,String sender,String message,String subject,String folder)throws Exception
{
Class.forName("sun.jdbc.odbc.JdbcOdbcDriver").newInstance();
Connection conn = DriverManager.getConnection("Jdbc :-o	 dbc:email");
Statement state= conn.createStatement();
java.util.Date mydt=new java.util.Date();
String dates = mydt.toString();
boolean read=false;
PreparedStatement ps = conn.prepareStatement("INSERT INTO Messages ( Userid, Message, Msg_dates, Sender,Read, Folder, Subject )VALUES (?,?,?,?,?,?,?)");
ps.setString(1,to);
ps.setString(2,message);
ps.setString(3,dates);
ps.setString(4,sender);
ps.setBoolean(5,read);
ps.setString(6,folder);
ps.setString(7,subject);
int modified = ps.executeUpdate();
//int modified = state.executeUpdate("INSERT INTO Messages ( Userid, Message, Msg_dates, Sender,Read, Folder, Subject )VALUES ('"+to+"','"+message+"','"+mydt+"', '"+sender+"',"+read+", '"+folder+"', '"+subject+"')");
if (modified == 1)
{
state.close();
conn.close();
return true;
}
else
{
state.close();
conn.close();
return false;
}
}

[Anonymous]

Hi! You must escape the "'" character. Because SQL thinks that the string end when it comes to "'" char.
public String SQLEscape( String pStr ){
String mStr;
mStr = pStr.replace( "'" , "''" );
return mStr;
}
That's it!
[ May 05, 2002: Message edited by: Mathias P.W Nilsson ]

[David O'Meara]

There was also a reply to your dulpicate thread in the JSP forum here
Please don't post the question in multiple forums.
Dave

[Craig Demyanovich]

Mathias,
This code is invalid based on the API docs for Java 2 SDK 1.3.1 and 1.4.0. The only replace() method documented is one that takes two characters, not two strings. Have you actually used this code?
Imran,
Why doesn't PreparedStatement work? Using PreparedStatement relieves you of the burden of escaping single quotes in parameters that contain them. That's the point of PreparedStatement.
Craig

[Imran Ahmed Khan]

Dear Mr. Mathias, u can see that i have used prepare statement, but it doesnt work in it either.

[Craig Demyanovich]

Here's code that I wrote quite some time ago. I was just commenting/uncommenting to use different methods. I did not have to escape single quotes when using PreparedStatement, as the comment in the code indicates. Note that these statements won't be committed to the table unless you uncomment the call to commit().
Here's the table that I used:

CREATE TABLE dbo.bu_test (
id int NULL ,
attr1 int NULL ,
attr2 int NULL ,
attr3 int NULL ,
attr4 char (7)
)

Here's the class:

import java.sql.*;
public class BatchUpdate {
    public static void main(String args[]) {
        String url =
        "your jdbc url";
        Connection conn;
        try {
            Class.forName("your driver class name");
        } catch(java.lang.ClassNotFoundException e) {
            System.err.print("ClassNotFoundException: ");
            System.err.println(e.getMessage());
        }
        try {
            conn = DriverManager.getConnection(url, "username", "password");
//            insertWithStatementBatch(conn);
            insertWithPreparedStatementBatch(conn);
//            System.out.println(replace("Craig's", "Crai", "Gre"));
            conn.close();
        } catch(BatchUpdateException b) {
            System.err.println("SQLException: " + b.getMessage());
            System.err.println("SQLState: " + b.getSQLState());
            System.err.println("Message: " + b.getMessage());
            System.err.println("Vendor: " + b.getErrorCode());
            System.err.print("Update counts: ");
            int [] updateCounts = b.getUpdateCounts();
            for (int i = 0; i < updateCounts.length; i++) {
                System.err.print(updateCounts[i] + " ");
            }
        } catch(SQLException ex) {
            System.err.println("SQLException: " + ex.getMessage());
            System.err.println("SQLState: " + ex.getSQLState());
            System.err.println("Message: " + ex.getMessage());
            System.err.println("Vendor: " + ex.getErrorCode());
        }
    }
    private static void insertWithStatementBatch(Connection conn)
            throws BatchUpdateException, SQLException {
        Statement stmt;
        long begin = 0;
        long end = 0;
        long records = 0;
        stmt = conn.createStatement(ResultSet.TYPE_SCROLL_SENSITIVE,
                                    ResultSet.CONCUR_UPDATABLE);
        conn.setAutoCommit(false);
        for(int i = 0; i < 12; i++) {
            for(int j = 0; j < 12; j++) {
                for(int k = 0; k < 12; k++) {
                    for(int l = 0; l < 12; l++) {
                        records++;
                        // need to escape embedded quote if present
                        stmt.addBatch("INSERT INTO bu_test"
                                + " VALUES(" + i + "," + j + ","
                                + k + "," + l + ",'Craigs')");
                    }
                }
            }
        }
        begin = System.currentTimeMillis();
        stmt.executeBatch();
//        conn.commit();
        end = System.currentTimeMillis();
        System.out.println();
        System.out.println("STATEMENT BATCH");
        System.out.println("Execution time:  " + (end - begin) + " ms");
        System.out.println("for " + records + " records");
//        ResultSet uprs = stmt.executeQuery("SELECT * FROM bu_test");
//        System.out.println("Table bu_test after insertion:");
//
//        while (uprs.next()) {
//            int id = uprs.getInt("id");
//            int attr1 = uprs.getInt("attr1");
//            int attr2 = uprs.getInt("attr2");
//            int attr3 = uprs.getInt("attr3");
//            String attr4 = uprs.getString("attr4");
//            System.out.println(id + " " + attr1 + " "
//                               + attr2 + " " + attr3 + " " + attr4);
//            System.out.println(uprs.getString("id"));
//        }
//        uprs.close();
        stmt.close();
    }
    private static void insertWithPreparedStatementBatch(Connection conn)
            throws BatchUpdateException, SQLException {
        PreparedStatement pstmt;
        long begin = 0;
        long end = 0;
        long records = 0;
        pstmt = conn.prepareStatement("INSERT INTO bu_test VALUES(?,?,?,?,?)");
        pstmt.setInt(1, 0);
        pstmt.setInt(2, 0);
        pstmt.setInt(3, 0);
        pstmt.setInt(4, 0);
        pstmt.setString(5, "Craig's");
        pstmt.addBatch();
        records++;
        conn.setAutoCommit(false);
        for(int i = 0; i < 12; i++) {
            for(int j = 0; j < 12; j++) {
                for(int k = 0; k < 12; k++) {
                    for(int l = 0; l < 12; l++) {
                        if(0 == i && 0 == j && 0 == k && 0 == l) {
                            // skip the first iteration since it was
                            // handled above
                            continue;
                        }
                        records++;
                        pstmt.setInt(1, i);
                        pstmt.setInt(2, j);
                        pstmt.setInt(3, k);
                        pstmt.setInt(4, l);
                        pstmt.setString(5, "Craig's");   // don't need to
                                                         // escape embedded
                                                         // quote
                        pstmt.addBatch();
                    }
                }
            }
        }
        begin = System.currentTimeMillis();
        pstmt.executeBatch();
//        conn.commit();
        end = System.currentTimeMillis();
        System.out.println();
        System.out.println("PREPARED STATEMENT BATCH");
        System.out.println("Execution time:  " + (end - begin) + " ms");
        System.out.println("for " + records + " records");
        pstmt.close();
    }
    /**
     * Replace in <code>source</code> each occurrence of <code>oldVal</code>
     * with <code>newVal</code>.  If <code>oldVal</code> is found and
     * <code>newVal</code> is <code>null</code>, each occurrence of
     * <code>oldVal</code> is removed from <code>source</code>.
     * <p>
     * @param source The <code>String</code> to search
     * @param oldVal The substring to replace
     * @param newVal The substring that will replace <code>oldVal</code>
     * <p>
     * @return <code>source</code> if <code>source</code> is <code>null</code>
     *         or <code>oldVal</code> is not found;<br>
     *         otherwise, a new <code>String</code> with replacements
     * <p>
     * @throws <code>NullPointerException</code> if <code>oldVal</code> is
     *         <code>null</code>
     */
    private static String replace(String source,
                                  String oldVal,
                                  String newVal) {
        if(source == null) {
            return source;
        }
        if(oldVal == null) {
            throw new NullPointerException("can't search for null value");
        }
        int startIndex = 0;
        int foundIndex = source.indexOf(oldVal, startIndex);
        if(-1 == foundIndex) {
            return source;
        } else {
            StringBuffer sb = new StringBuffer(source);
            while(foundIndex != -1) {
                if(newVal == null) {
                    sb.delete(foundIndex, foundIndex + oldVal.length());
                    startIndex = foundIndex;
                } else {
                    sb.replace(foundIndex,
                               foundIndex + oldVal.length(),
                               newVal);
                    startIndex = foundIndex + newVal.length() + 1;
                }
                foundIndex = sb.toString().indexOf(oldVal, startIndex);
            }
            return sb.toString();
        }
    }
}

Craig
[ May 06, 2002: Message edited by: Craig Demyanovich ]