Question

How to replace single quote in Java with Postgres?

select * from where id in ('<45646300.KDSFJJSKJSDF95'fdgdfgdfgd>', 'fdgdfgdg');

I always use params like

select * from where id = ?;

But in this case i have problem, where i have ‘in’ statement with string passed to it.

I wish to replace all dangerous chars

Answer 1

It would be better to continue using PreparedStatements rather than to escape characters manually.

In the case of IN clause you can generate a query with appropriate number of ?s dynamically.

String[] input = ...;

StringBuilder b = new StringBuilder();
b.append("select * from where id in (");
b.append("?"); // Assume that input contains at least one element
for (int i = 1; i < input.length; i++) b.append(", ?");
b.append(")");

PreparedStatement s = c.prepareStatement(b.toString());

for (int i = 0; i < input.length; i++) s.setString(i + 1, input[i]);