how to deal with the special character in java and oracle!!!

[Geoffrey Ren]

when I got the user inputting. For example, user input the value "test's"/"test&s"/"test\s". How to insert the value into oracle DB by jdbc.
Thanks for you reply!

[Jamie Robertson]

PreparedStatement will do the escaping for you:

PreparedStatement ps = con.prepareStatement( "INSERT INTO table ( id, value ) values ( ?, ? )" );
ps.setInt( 1, 5 );
ps.setString( 2, "test's\"/\"test&s\"/\"test\\s" );
ps.executeUpdate();
con.commit(); 

either that or do a loop and escape every "bad" character in the string. The choice is usually PreparedStatement.
Jamie

[Peter den Haan]

Anything other than a PreparedStatement is madness. This becomes even clearer when you start to consider things like date formats. Ok, so you could use ANSI SQL escape syntax -- hands up everyone who can write down a date literal using escape syntax without consulting some kind of reference! And now hands up those who'd never heard of this syntax before... Thought so.
- Peter

[Surendran Velath]

You can use a Statement also
stmt.executeUpdate("test''s"/"test&s"/"test\s");
only remember that a single quote needs an additional single quote
test''s
all other characters are accepted directly