Question

I have a database with names in it such as John Doe etc. Unfortunately some of these names contain quotes like Keiran O’Keefe. Now when I try and search for such names as follows:

SELECT * FROM PEOPLE WHERE SURNAME='O'Keefe'  

I (understandably) get an error.

How do I prevent this error from occurring. I am using Oracle and PLSQL.

Answer 1

The escape character is ‘, so you would need to replace the quote with two quotes.

For example,

SELECT * FROM PEOPLE WHERE SURNAME='O'Keefe'

becomes

SELECT * FROM PEOPLE WHERE SURNAME='O''Keefe'

That said, it’s probably incorrect to do this yourself. Your language may have a function to escape strings for use in SQL, but an even better option is to use parameters. Usually this works as follows.

Your SQL command would be :

SELECT * FROM PEOPLE WHERE SURNAME=?

Then, when you execute it, you pass in ‘O’Keefe’ as a parameter.

Because the SQL is parsed before the parameter value is set, there’s no way for the parameter value to alter the structure of the SQL (and it’s even a little faster if you want to run the same statement several times with different parameters).

I should also point out that, while your example just causes an error, you open youself up to a lot of other problems by not escaping strings appropriately. See http://en.wikipedia.org/wiki/SQL_injection for a good starting point or the following classic xkcd comic.