Question

I’m having trouble with an SQL query. The problem is that I’m querying an external database of enterprise names and some names are like “Martha’s” (include apostrophes). And because I’m querying from an android app, the query string looks like:

String query = "Select * from Advertiser where AdvName= '" + name + "';";

So is there anyway I could ignore or change the apostrophes in the query?

Thanks in advance!

Answer 1

That’s one of the reasons why you should always use prepared statements when executing parameterized queries:

String sql = "select * from Advertiser where AdvName = ?";
PreparedStatement stmt = connection.prepareStatement(sql);
stmt.setString(1, name);
ResultSet rs = stmt.executeQuery();

The JDBC driver will escape the quotes for you, and this will also prevent SQL injection attacks.

Prepared statements also have performance advantages when you must execute the same query several times but with different parameters.

Read more about prepared statements in the JDBC tutorial.

Side note: you shouldn’t have a ; at the end of your query.