Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I have written code to store some headline’s from news websites in a database. However the headlines also contain (‘) single quotes and double quotes from time to time and this causes an error when trying to insert it into the table.
What would be the best possible way to ge around this?
Here is my code:
Statement st = con.createStatement();
int val = st.executeUpdate("INSERT into imageinfo(imageurl,title,headline,website) VALUES('"+imageurl+"','"+title+"','"+headline+"','"+website+"')");
You should consider using Prepared Statements where your SQL queries are precompiled. Depending on where your data is coming from in the first place this may also guard against SQL Injections.
Another advantage of using prepared statements is that you can reuse the same statement with different parameters each time you execute it.