| Author |
Problems of Quotations in SQL Syntax
|
Adnan Memon
Ranch Hand
Joined: Mar 09, 2003
Posts: 32
|
|
|
Its been a problem where we are to post data input by user to databases..user can put any number of quotation marks single or double...one proactive approach is to parse the input text before constructing SQL query...i want to know is there any well known solution to it?
|
 |
Paul Sturrock
Bartender
Joined: Apr 14, 2004
Posts: 10336
|
|
|
Yes. Used a PreparedStatement. This explicitly binds Strings to statement values, so you can chuck it any number of characters which will cause problems in an ordinary statement and it will correctly escape them.
|
JavaRanch FAQ HowToAskQuestionsOnJavaRanch
|
|
 |
|
|
subject: Problems of Quotations in SQL Syntax
|
|
|
0
