Question

I am inserting values in a Mysql database from java file using –

String query = "INSERT INTO genes (sent, title) VALUES ('"+sent+"','"+title+"')";
Statement stmt = con.createStatement();
int rs = stmt.executeUpdate(query);

where sent and title are variable strings extracted after applying some algorithm. But this gives sql error when sent or title contains single qoutes.

Answer 1

Consider using a prepared statement with parameters:

PreparedStatement pstmt = con.prepareStatement(
    "INSERT INTO genes (sent, title) VALUES (?, ?)");
pstmt.setString(1, sent);
pstmt.setString(2, title);
pstmt.executeUpdate();