如何转义SQL插入的单引号...当要插入的字符串在用户生成的变量中时

Question

我正在构建一个使用jdbc执行的insert命令.部分是连接用户生成的字符串...这一切都有效,直到用户使用这样的字符串:

A B C D

String userString="a'bcd";
String insertTableSQL = "INSERT INTO myTable "
                            + "(insertColumn) " 
                            + "VALUES("
                                +"'"+userString+"'"
                                +")";

statement.executeUpdate(insertTableSQL);

Answer 1

您可以执行以下任一操作:

1. 使用PreparedStatement类.(推荐)

   String userString="a'bcd";
   String myStatement = " INSERT INTO MYTABLE (INSERTCOLUMN) VALUES (?)";
   PreparedStatement statement= con.prepareStatement   (myStatement );
   statement.setString(1,userString);
   statement.executeUpdate();
   

2. 逃避单引号.

   在SQL中,单引号将使用双引号进行转义.'- >''

   String userString="a'bcd";
   String changedUserString = userString.replace("'","''");
           //changedUserString  = a''bcd
   String insertTableSQL = "INSERT INTO myTable (insertColumn) VALUES("
                           +" '"+changedUserString +"' )";
   

Answer 2

您可以使用StringEscapeUtils从阿帕奇共享郎库.使用它你可以转义html,xml,sql等字符escapeXXX.为你的目的寻找方法.供参考:当我需要转义Html字符串？

注意:escapeSql已在Apache Commons Lang 3中删除(请参阅从commons.lang迁移StringEscapeUtils.escapeSql,其中引用了https://commons.apache.org/proper/commons-lang/article3_0.html#StringEscapeUtils.escapeSql)

例如:

String str = FileUtils.readFileToString(new File("input.txt"));
        String results = StringEscapeUtils.escapeHtml(str);
        System.out.println(results);

输入:

<sometext>
Here is some "Text" that I'd like to be "escaped" for HTML
& here is some Swedish: Tack. Vars?god.
</sometext>

输出:

<sometext>
Here is some "Text" that I'd like to be "escaped" for HTML
& here is some Swedish: Tack. Varsågod.
</sometext>