Question

I am using hibernate application in java to retrieve and update database.

During updating a table,i forming an sql query as follows,

String qry = "UPDATE " + entity  + " SET " + htmlColumn + " ='"+value+"' WHERE " + id + " = " + primaryId;

where value is a html string which contains single quotes sometimes.

How to escape ignore/escape the single quotes and update the table successfully

Thanks

Answer 1

Don’t set values directly.

currentSession()
    .createQuery("UPDATE " + entity  + " SET " + htmlColumn +
              " = :value WHERE " + id + " :id")
    .setParameter("value", value).setParameter(":id",id).executeUpdate();