如何逃避像在android中的sqlite中的特殊字符

Question

我有一个函数,它在SQLite数据库中的表上执行查询.我宣布一个常数:public static final String CANADA_HISTORY = "Canada's History";.这存储在一个String变量中,比方说difficulty,

我有一个问题:

Cursor c = mDb.rawQuery("select * from Questions_answers where CHAPTERS = '"+difficulty+"'" , null);

它在撇号附近抛出异常.

Logcat输出:

I/Database( 1170): sqlite returned: error code = 1, msg = near "s": syntax error
D/AndroidRuntime( 1170): Shutting down VM
W/dalvikvm( 1170): threadid=1: thread exiting with uncaught exception (group=0x40015560)
E/AndroidRuntime( 1170): FATAL EXCEPTION: main
E/AndroidRuntime( 1170): android.database.sqlite.SQLiteException: near "s": syntax error: , while compiling: select * from Questions_answers where CHAPTERS  = 'Canada's History'

我也尝试过:

1.  difficulty=difficulty.replaceAll("'","''");
2.  difficulty=difficulty.replaceAll("'","\'");
3.  difficulty = DatabaseUtils.sqlEscapeString(difficulty);

除此之外,它对我来说是单词Canada History,我的意思是没有特殊的字符.

请给我解决问题的建议谢谢.

Answer 1

SQL标准指定通过在行中放入两个单引号来转义字符串中的单引号.SQL就像Pascal编程语言一样.SQLite遵循此标准.例:

INSERT INTO xyz VALUES('5 O''clock');

参考:SQLite常见问题

Answer 2

最好的方法是使用专为此目的而设计的原生Android方法:

DatabaseUtils.sqlEscapeString(String)

这是在线的文档:

• Android开发者身上的sqlEscapeString()

在我看来,使用这种方法的主要优点是自我记录,因为方法名称清晰.

Answer 3

首先用这个替换char

difficulty=difficulty.replaceAll("'","\\'");

然后在您的查询中传递它

"select * from Questions_answers where CHAPTERS='"+difficulty+"'";

编辑:

 q = "select * from Questions_answers where CHAPTERS = ?";
    database.rawQuery(q, new String[] { difficulty});

Answer 4

对我有用的是

if (columnvalue.contains("'")) {
    columnvalue = columnvalue.replaceAll("'", "''");
}