Avoiding quotation marks "" characters in MySQL and Java

Question

How can we escape the quotes "" characters in Java and MySQL?

The input XML file has quotation marks, and I am viewing this file using Java. Therefore, I want to avoid quotes here, but it must contain quotation marks in the database. When I make a request, the result will have quotation marks. When showing on a web page, it should also show quotation marks.

Answer 1

Let me try to understand ...

The input file has quotation marks in it. You want to send it to the database. When you return from the database, you still want these quotes to be there.

So it's just in / out of the database, what do you have a problem?

If so, I very much suspect that you are doing something in order: (I wrap it in a disclaimer so as not to suspect misunderstanding and trimming / pasting into my own applications .;))

Bad - don't do it

 String sql = "insert into foo (bar,baz) values(" +myValue1 + ", " + myValue2 + ")"; Statement stmt = connection.createStatement(); stmt.executeUpdate(sql); 

Bad - don't do it

If so, you should really use the prepared instruction parameters at a minimum. a) you will be less vulnerable to malicious garbage that deletes all your tables, and b) you will not have problems with screening.

 String sql = "insert into foo (bar, baz) values( ?, ? )"; PreparedStatement stmt = connection.prepareStatement(sql); stmt.setString(1, myValue1); stmt.setString(2, myValue2); stmt.executeUpdate(); 

Please note that this is also safe in the case of things like CLOB and the features of various database implementations (I think of you, Oracle>))

If this is some other way of escaping, that is, to / from XML or to / from HTML, then this is different, but it is well documented throughout the Internet.

Or provide some sample code if I'm not completely in the database.

Answer 2

A typical escape character for anything is the backslash \ .

Answer 3

You should use:

 \" 

Answer 4

Nothing (OK, nothing), but most characters use

  \ 

as an escape character.

Answer 5

The obvious (and best) thing is what everyone else has suggested. The dumb option is to put a double quote inside one quote:

 String quotedText = '"' + "A quick brown fox..." + '"';