Question

String username="abc";
String pwd="abc";

String query="Select username,pwd where username = ? and pwd = ?";

I want to replace character '?' in this string by different values with username and pwd specifed..Is there any function by which we can find '?' which is there two times and replace it with username and pwd?

Answer 1

Sure, have a look at String.replaceFirst for instance:

String query = "Select username,pwd where username = ? and pwd = ?"
                       .replaceFirst("\\?", username)
                       .replaceFirst("\\?", pwd)

Keep in mind though, that you probably want to properly escape username and pwd.

Consider for instance what happens if I provide something like

 or 1=1

as password.

For more information on this, have a look at the various answers to:

• Java – escape string to prevent SQL injection

---

If possible, use PreparedStatements!

• Using Prepared Statements