This week's book giveaway is in the OO, Patterns, UML and Refactoring forum. We're giving away four copies of Refactoring for Software Design Smells: Managing Technical Debt and have Girish Suryanarayana, Ganesh Samarthyam & Tushar Sharma on-line! See this thread for details.
Its been a problem where we are to post data input by user to databases..user can put any number of quotation marks single or double...one proactive approach is to parse the input text before constructing SQL query...i want to know is there any well known solution to it?
Yes. Used a PreparedStatement. This explicitly binds Strings to statement values, so you can chuck it any number of characters which will cause problems in an ordinary statement and it will correctly escape them.