How to parse hyphen in form post?

[Chuan Ren]

I am doing a form post to get a description input from user.

<INPUT class=inputText TYPE="text" NAME="f_description" MAXLENGTH="200" SIZE="40" VALUE="">
String l_description= request.getParameter("f_description");
String sqlInsert="INSERT INTO myTable (DESCRIPTION) VALUES('"+l_description +"')";
CM.executeUpdate (sqlInsert);  

I am using Oracle database. When the data entered consist of ', (, ) it will break the sql Statement. What can I do to solve this problem?
Thank you.

[Bear Bibeault]

Not a JSP question, so I'm moving this along to the JDBC forum.

[Jeanne Boyarsky]

Chuan,
You can either escape the special characters (like single quote) with a backslash or use a prepared statement. I recommend the prepared statement because it takes care of these details for you.

[Chuan Ren]

I am learning this from Mastering JSP chapter 13 which uses the connection manager bean. The sample code from the book is such:

<jsp:useBean class="com.db.ConnectionManager" id="CM" scope="session" />
<%@ page import="java.sql.*" %>
<%
String l_username = "user2";
String sql = "UPDATE User_Table SET phone=1234 WHERE username='"+l_username+"'";
CM.executeUpdate(sql);
%>

The code seems tidy from a JSP page. however if it's a form post, and the l_username contains hyphen or ' or ), the sql statement breaks. How do I incorporate prepare statement in the above situation?

[Jeanne Boyarsky]

Sun's short course has a good example. Just scroll down to the section on prepared statements.
Since the example was from a book on JSPs, the author was probably trying to explain how to do a query in the most basic way than to provide an extremely robust solution.