Acceptaing a variable with a quote in it

Question

Hi Guys, searched quite a bit but couldn't really find what I need.
I have a sql report generated from a simple query where the user can type in what they need, I accept the parameter and generate the report, here is teh simple form for this question:
select * from vendors
where vendor name like '&1';
Thats it, the user can type what they wish and teh sql will look for it. Unfortunately, some of the vendor names have things like SMITH'S or CLARKE'S
So when I run teh sql I get quoted string not terminated correctly. My issue is as this is a parameter cioming in, how can get a doulbe quote in their, any help would be great
Thanks

Answer 1

user12243721 wrote:
Thanks for the response but this:
select * from vendors
where vendor_name like Q'[&1]'; doesn't work.
and in fact I need it to be encased in wild cards, so the prompt needs to read:
select * from vendors
where vendor_name like Q'[%&1%]';
I forgot to mention the wild cards sorry, but regardless I tried both ways with the same error. I am on version 9.2.04 of oracle, not that it is really relevant in this case. Well it is relevant. I think the "q" qualifier syntax was introduced in version 10. I am not sure thou. What does "it does not work" mean? What is the exact error message?
Of cause we will assume that you are using a currently supported version of the database. If this is not the case you must supply this essential information.
The problem is that you use a lexical replacement (&) as a parameter. While usually it works, it is a serious design flaw. It can even go so far to open doors for sql injection attacks.
So better is to use variables instead of lexiacl replacements. Real (bind) variables are used with an added : in front of them. Question is still how to let the user enter those variables. See the following examples:
SQL> var vname varchar2(100);
SQL> exec :vname := 'Test';
PL/SQL procedure successfully completed.
SQL> print vname
VNAME
Test
SQL> select :vname from dual;
:VNAME
Test
SQL> accept
SP2-0002: ACCEPT statement must specify a variable name
SQL> accept vname prompt "Enter name search:"
Enter name search:test
SQL> print vname
VNAME
Test
SQL> accept vname prompt "Enter name search:"
Enter name search:Abc'Def
SQL> print vname
VNAME
Test
"problem!"
If using the sqlplus command accept then any input strings with hyphens like ' are silently ignored.
SQL> select * from dual where 'Test' like '%'||vname||'%';
select * from dual where 'Test' like '%'||vname||'%'
ERROR at line 1:
ORA-00904: "VNAME": invalid identifier
SQL> select * from dual where 'Test' like '%'||:vname||'%';
D
XWhich client tools can you use to let the user input this search string? Only sql*plus or is there any other tool? Like in SQL Developer it will prompt you for input, when you have a bind variable inside the statement.