适用于Google App Engine的JDO:转义引号

Question

如何在JDO(Google App Engine)中转义查询参数？

例如,如果变量名称可能包含不安全的字符作为单引号('),如何使下一个代码段安全？

PersistenceManager pm = ...;
String query = "select from Person where name='"+name+"'";
List<Shortened> shortened = (List<Shortened>) pm.newQuery(query).execute();

Answer 1

相反,使用查询参数,它比包含查询本身中的值更安全.以下是GAE文档中的示例:

Query query = pm.newQuery("select from Employee " +
                          "where lastName == lastNameParam " +
                          "order by hireDate desc " +
                          "parameters String lastNameParam");

List<Employee> results = (List<Employee>) query.execute("Smith");