Again same problem with quotes, but cant find a proper sol

Question

I've gone thru so many posts, but cud'nt really find a solution. someone please help me here. I have a single insert function, which does all inserts for many tables, so cant use ppdstmt.setString(1, "value").
I am trying to insert some data into SQL server database(thru jdbc). The normal data works just fine, but if the user inserts some data which have quotation marks, then its throwing an error that is invalid character.
ex: received ->enters correctly into db
but
rec'd -> unable to
Insert into table(name) values('Oreilly'); //works fine
Insert into table(name) values('O'reilly'); //throws an error, sql exception
because the sql server is unable to find the matching quote. I would like to replace it with a ` or double quotes, but I am unable to replace it. I am not using a string to insert a value, I am using an Object. so I am unable to use any preparedStatement also(like ppdstmt.setString(1,"value"). Also I cant use replaceAll function, because, I am using jdk1.3. Is there any other way, I can replace ' with '' or `. The following is my code for inserting data.
private void insert(String pQualifierName, String pTableName, Map pValueMap)
m1Buffer.append("INSERT INTO ").append(QualifyTableName(pQualifierName, pTableName)).append(" (");
m2Buffer.append(" VALUES (");
// go over all values
boolean isNotFirst = false;
for (Iterator i = pValueMap.keySet().iterator(); i.hasNext();)
if (isNotFirst)
m1Buffer.append(", ");
m2Buffer.append(", ");
isNotFirst = true;
String aColumnName = (String) i.next();
// add the column name to the first part
m1Buffer.append(aColumnName);
// add a "?" to the second part, as well as adding the value to the parameter list
if(pValueMap.get(aColumnName)!= null) {
//aColumnName=aColumnName.replace( '\'', '`');
m2Buffer.append("'");
m2Buffer.append(pValueMap.get(aColumnName));
m2Buffer.append("'");
} else {
m2Buffer.append(pValueMap.get(aColumnName)); //appends the value we entered
m1Buffer.append(")");
m2Buffer.append(")");
protected void insert()
verifyUnbacked();
try
StatementBuilder aBuilder = StatementBuilder.insertStatement(accessQualifierName(), accessTableName(), mUnbackedMap);
Connection aConnection = ConnectionPool.getConnection();
try
PreparedStatement aPreparedStatement = aBuilder.generatePreparedStatement(aConnection);
try
aPreparedStatement.executeUpdate();
Thanks

Answer 1

Barun_guha,
Thanks for your code, but the problem is pValueMap.get(aColumnName) is an Object and it cannot be initialized as a String .
scsi-boy,
I am attaching the 2 files related, StatementBuilder.java and AbstractEntity.java.
Basically, the statementBuilder.java builds the SQL stmt and AbstractEntity.java does the update, delete and inserts(it has the PreparedStament). So could someone suggest me a solution based on this code.
Thanks
import firstpro.util.AbstractType;
import java.sql.*;
import java.util.*;
public class StatementBuilder
private static final StatementType SELECT = new StatementType("SELECT");
private static final StatementType INSERT = new StatementType("INSERT");
private static final StatementType IDENTITY = new StatementType("IDENTITY");
private static final StatementType UPDATE = new StatementType("UPDATE");
private static final StatementType DELETE = new StatementType("DELETE");
* is true when the prepared statment can be set as "read-only" (i.e., a select of some kind).
private boolean mIsReadOnly = false;
* denotes what operation this statement represents.
private StatementType mStatementType;
* accumulates all the table names used in the statement.
private List mTableList = new ArrayList();
* holds the sequence of tables followed in join expressions.
private LinkedList mTableStack = new LinkedList();
* accumulates the table column names referenced in the statement.
private Set mReferenceSet = new HashSet();
* holds the column names used in the select result.
private List mResultColumnList = new ArrayList();
* is the first part of the generated SQL statement.
private StringBuffer m1Buffer = new StringBuffer();
* is the second part of the generated SQL statement.
private StringBuffer m2Buffer = new StringBuffer();
* holds the list of actual parameter values to substitute for the "?" symbols in the generated SQL.
private List mParameterList = new ArrayList();
* constructs an instance with the given type.
* @param pStatementType
private StatementBuilder(StatementType pStatementType)
mStatementType = pStatementType;
* creates a "select" statement.
* @param pQualifierName
* @param pTableName
* @param pCondition
* @param pResult
* @return
static StatementBuilder selectStatement(String pQualifierName, String pTableName, AbstractEntityCondition pCondition, AbstractEntityResult pResult)
StatementBuilder aBuilder = new StatementBuilder(SELECT);
aBuilder.select(pQualifierName, pTableName, pCondition, pResult);
return aBuilder;
* creates a "select distinct" statement.
* @param pQualifierName
* @param pTableName
* @param pCondition
* @param pResult
* @return
static StatementBuilder distinctStatement(String pQualifierName, String pTableName, AbstractEntityCondition pCondition, AbstractEntityResult pResult)
StatementBuilder aBuilder = new StatementBuilder(SELECT);
aBuilder.distinct(pQualifierName, pTableName, pCondition, pResult);
return aBuilder;
* creates a "select count(*)" statement.
* @param pQualifierName
* @param pTableName
* @param pCondition
* @return
static StatementBuilder countStatement(String pQualifierName, String pTableName, AbstractEntityCondition pCondition)
StatementBuilder aBuilder = new StatementBuilder(SELECT);
aBuilder.count(pQualifierName, pTableName, pCondition);
return aBuilder;
* creates in "insert" statement.
* @param pQualifierName
* @param pTableName
* @param pValueMap
* @return
static StatementBuilder insertStatement(String pQualifierName, String pTableName, Map pValueMap)
StatementBuilder aBuilder = new StatementBuilder(INSERT);
aBuilder.insert(pQualifierName, pTableName, pValueMap);
return aBuilder;
* creates an "identity" statement (for retrieving the generated primary key from the DB after an insert).
* @param pTypeName
* @return
static StatementBuilder identityStatement(String pTypeName)
StatementBuilder aBuilder = new StatementBuilder(IDENTITY);
aBuilder.identity(pTypeName);
return aBuilder;
* creates an "update" statement.
* @param pQualifierName
* @param pTableName
* @param pValueMap
* @param pCondition
* @return
static StatementBuilder updateStatement(String pQualifierName, String pTableName, Map pValueMap, AbstractEntityCondition pCondition)
StatementBuilder aBuilder = new StatementBuilder(UPDATE);
aBuilder.update(pQualifierName, pTableName, pValueMap, pCondition);
return aBuilder;
* creates a "delete" statement.
* @param pQualifierName
* @param pTableName
* @param pCondition
* @return
static StatementBuilder deleteStatement(String pQualifierName, String pTableName, AbstractEntityCondition pCondition)
StatementBuilder aBuilder = new StatementBuilder(DELETE);
aBuilder.delete(pQualifierName, pTableName, pCondition);
return aBuilder;
* emits a predicate of "true".
void trueAlways()
appendTrue();
* emits a predicate of "false".
void falseAlways()
appendFalse();
* emits a "join" predicate.
* @param pColumnName
* @param pQualifierName
* @param pJoinedTableName
* @param pJoinedColumnName
* @param pCondition
void join(String pColumnName, String pQualifierName, String pJoinedTableName, String pJoinedColumnName, AbstractEntityCondition pCondition)
if (!SELECT.equals(mStatementType))
throw new RuntimeException("Join only allowed in SELECT");
appendOpening();
appendColumn(pColumnName);
appendEqualTo();
pushTable(pQualifierName, pJoinedTableName);
appendColumn(pJoinedColumnName);
appendClosing();
appendAnd();
appendOpening();
appendCondition(pCondition);
appendClosing();
popTable();
* emits an "and" predicate.
* @param pCondition1
* @param pCondition2
void and(AbstractEntityCondition pCondition1, AbstractEntityCondition pCondition2)
appendOpening();
appendCondition(pCondition1);
appendClosing();
appendAnd();
appendOpening();
appendCondition(pCondition2);
appendClosing();
* emits an "and" predicate.
* @param pConditionArray
void and(AbstractEntityCondition[] pConditionArray)
if (0 == pConditionArray.length)
appendTrue();
else
for (int i = 0; i < pConditionArray.length; i++)
if (i != 0)
appendAnd();
appendOpening();
appendCondition(pConditionArray);
appendClosing();
* emits an "or" predicate.
* @param pCondition1
* @param pCondition2
void or(AbstractEntityCondition pCondition1, AbstractEntityCondition pCondition2)
appendOpening();
appendCondition(pCondition1);
appendClosing();
appendOr();
appendOpening();
appendCondition(pCondition2);
appendClosing();
* emits an "or" predicate.
* @param pConditionArray
void or(AbstractEntityCondition[] pConditionArray)
if (0 == pConditionArray.length)
appendFalse();
else
for (int i = 0; i < pConditionArray.length; i++)
if (i != 0)
appendOr();
appendOpening();
appendCondition(pConditionArray[i]);
appendClosing();
* emits a "not" predicate.
* @param pCondition
void not(AbstractEntityCondition pCondition)
appendNot();
appendOpening();
appendCondition(pCondition);
appendClosing();
* emits an "is null" predicate.
* @param pColumnName
void isNull(String pColumnName)
appendColumn(pColumnName);
appendIsNull();
* emits an "is not null" predicate.
* @param pColumnName
void isNotNull(String pColumnName)
appendColumn(pColumnName);
appendIsNotNull();
* emits a "between" predicate.
* @param pColumnName
* @param pValue1
* @param pValue2
void isBetween(String pColumnName, Object pValue1, Object pValue2)
appendColumn(pColumnName);
appendBetween();
appendValue(pValue1);
appendAnd();
appendValue(pValue2);
* emits a case-insensitive "between" predicate.
* @param pColumnName
* @param pValue1
* @param pValue2
void isBetweenIgnoringCase(String pColumnName, Object pValue1, Object pValue2)
appendColumnUpper(pColumnName);
appendBetween();
appendValueUpper(pValue1);
appendAnd();
appendValueUpper(pValue2);
* emits a "like" predicate.
* @param pColumnName
* @param pValue
void isLike(String pColumnName, Object pValue)
appendColumn(pColumnName);
appendLike();
appendValue(pValue);
* emits a case-insensitive "like" predicate.
* @param pColumnName
* @param pValue
void isLikeIgnoringCase(String pColumnName, Object pValue)
appendColumnUpper(pColumnName);
appendLike();
appendValueUpper(pValue);
* emits an "equals" predicate.
* @param pColumnName
* @param pValue
void isEqualTo(String pColumnName, Object pValue)
appendColumn(pColumnName);
appendEqualTo();
appendValue(pValue);
* emits a case-insensitive "equals" predicate.
* @param pColumnName
* @param pValue
void isEqualToIgnoringCase(String pColumnName, Object pValue)
appendColumnUpper(pColumnName);
appendEqualTo();
appendValueUpper(pValue);
* emits an "unequals" predicate.
* @param pColumnName
* @param pValue
void isNotEqualTo(String pColumnName, Object pValue)
appendColumn(pColumnName);
appendNotEqualTo();
appendValue(pValue);
* emits a case-insensitive "unequals" predicate.
* @param pColumnName
* @param pValue
void isNotEqualToIgnoringCase(String pColumnName, Object pValue)
appendColumnUpper(pColumnName);
appendNotEqualTo();
appendValueUpper(pValue);
* emits a "less than" predicate.
* @param pColumnName
* @param pValue
void isLessThan(String pColumnName, Object pValue)
appendColumn(pColumnName);
appendLessThan();
appendValue(pValue);
* emits a case-insensitive "less than" predicate.
* @param pColumnName
* @param pValue
void isLessThanIgnoringCase(String pColumnName, Object pValue)
appendColumnUpper(pColumnName);
appendLessThan();
appendValueUpper(pValue);
* emits a "less than or equals" predicate.
* @param pColumnName
* @param pValue
void isLessThanOrEqualTo(String pColumnName, Object pValue)
appendColumn(pColumnName);
appendLessThanOrEqualTo();
appendValue(pValue);
* emits a case-insensitive "less than or equals" predicate.
* @param pColumnName
* @param pValue
void isLessThanOrEqualToIgnoringCase(String pColumnName, Object pValue)
appendColumnUpper(pColumnName);
appendLessThanOrEqualTo();
appendValueUpper(pValue);
* emits a "greater than" predicate.
* @param pColumnName
* @param pValue
void isGreaterThan(String pColumnName, Object pValue)
appendColumn(pColumnName);
appendGreaterThan();
appendValue(pValue);
* emits a case-insensitive "greater than" predicate.
* @param pColumnName
* @param pValue
void isGreaterThanIgnoringCase(String pColumnName, Object pValue)
appendColumnUpper(pColumnName);
appendGreaterThan();
appendValueUpper(pValue);
* emits a "greater than or equals" predicate.
* @param pColumnName
* @param pValue
void isGreaterThanOrEqualTo(String pColumnName, Object pValue)
appendColumn(pColumnName);
appendGreaterThanOrEqualTo();
appendValue(pValue);
* emits a case-insensitive "greater than or equals" predicate.
* @param pColumnName
* @param pValue
void isGreaterThanOrEqualToIgnoringCase(String pColumnName, Object pValue)
appendColumnUpper(pColumnName);
appendGreaterThanOrEqualTo();
appendValueUpper(pValue);
* builds a "select" statment.
* @param pQualifierName
* @param pTableName
* @param pCondition
* @param pResult
private void select(String pQualifierName, String pTableName, AbstractEntityCondition pCondition, AbstractEntityResult pResult)
// this statment only reads from the DB
mIsReadOnly = true;
// initialize the table stack using the selected table
// the first push will write " FROM ..."
pushTable(pQualifierName, pTableName);
// build SELECT
StringBuffer sb = new StringBuffer();
// go over all columns
for (int i = 0; i < pResult.mColumnNameList.size(); i++)
// first one has command, others separate with commas
sb.append(i == 0 ? "SELECT DISTINCT TOP 100 " : ", ");
// get column name reference
String aQualifiedColumnName = QualifyColumnName((String) pResult.mColumnNameList.get(i));
// append to the statment
sb.append(aQualifiedColumnName);
// add to the result list
mResultColumnList.add(aQualifiedColumnName);
sb.append(" ");
// insert the "SELECT ..." before the " FROM ..." that was written on the push above
m1Buffer.insert(0, sb);
// do WHERE
if (pCondition != null)
m2Buffer.append(" WHERE ");
// will add to both "FROM..." in first buffer and to "WHERE ..." in second buffer
// this call does most of the hard work, and handles joins to other tables, etc.
appendCondition(pCondition);
// do ORDER BY
for (int i = 0; i < pResult.mOrderByList.size(); i++)
m2Buffer.append(i == 0 ? " ORDER BY " : ", ");
// column name
String aQualifiedColumnName = QualifyColumnName((String) pResult.mOrderByList.get(i));
// direction (ASC or DESC)
m2Buffer.append(aQualifiedColumnName).append(" ").append(pResult.mOrderByDirectionList.get(i));
popTable();
* is currently identical to "select"
* @param pQualifierName
* @param pTableName
* @param pCondition
* @param pResult
private void distinct(String pQualifierName, String pTableName, AbstractEntityCondition pCondition, AbstractEntityResult pResult)
select(pQualifierName, pTableName, pCondition, pResult);
* builds a "count(*)" statement.
* @param pQualifierName
* @param pTableName
* @param pCondition
private void count(String pQualifierName, String pTableName, AbstractEntityCondition pCondition)
// this statment only reads from the DB
mIsReadOnly = true;
// initialize the table stack using the selected table
// the first push will write " FROM ..."
pushTable(pQualifierName, pTableName);
// build and insert "SELECT ..." before the " FROM ..." that was written on the push above
m1Buffer.insert(0, "SELECT COUNT(*) ");
// do WHERE
if (pCondition != null)
m2Buffer.append(" WHERE ");
// will add to both "FROM..." in first buffer and to "WHERE ..." in second buffer
// this call does most of the hard work, and handles joins to other tables, etc.
appendCondition(pCondition);
// finished with this table
popTable();
private void insert(String pQualifierName, String pTableName, Map pValueMap)
// m1Buffer.append("set identity_insert " + pTableName + " off "+ " ").append("INSERT INTO ").append(QualifyTableName(pQualifierName, pTableName)).append(" (");
m1Buffer.append("INSERT INTO ").append(QualifyTableName(pQualifierName, pTableName)).append(" (");
m2Buffer.append(" VALUES (");
// go over all values
boolean isNotFirst = false;
for (Iterator i = pValueMap.keySet().iterator(); i.hasNext();)
if (isNotFirst)
m1Buffer.append(", ");
m2Buffer.append(", ");
isNotFirst = true;
String aColumnName = (String) i.next();
// add the column name to the first part
m1Buffer.append(aColumnName);
// add a "?" to the second part, as well as adding the value to the parameter list
if(pValueMap.get(aColumnName)!= null) {
//Object column= pValueMap.get(aColumnName);
aColumnName=aColumnName.replace( '\'', '`');
m2Buffer.append("'");
m2Buffer.append(pValueMap.get(aColumnName));
m2Buffer.append("'");
} else {
m2Buffer.append(pValueMap.get(aColumnName));
m1Buffer.append(")");
m2Buffer.append(")");
* builds a key-retrieval statement.
//* @param pTypeName
protected void identity(String pTypeName)
m2Buffer.append("SELECT CAST( @@IDENTITY AS "+ pTypeName + ")" );
private void update(String pQualifierName, String pTableName, Map pValueMap, AbstractEntityCondition pCondition)
m1Buffer.append("UPDATE ").append(QualifyTableName(pQualifierName, pTableName)).append(" SET ");
// go over all values
boolean isNotFirst = false;
for (Iterator i = pValueMap.keySet().iterator(); i.hasNext();)
if (isNotFirst)
m1Buffer.append(", ");
isNotFirst = true;
String aColumnName = (String) i.next();
// add the column name to the first part
m1Buffer.append(aColumnName);
m1Buffer.append(" = ");
// add a "?" to the second part, as well as adding the value to the parameter list
if((pValueMap.get(aColumnName)) == null) {
m1Buffer.append(pValueMap.get(aColumnName));
// System.out.println("NUll values are= " + pValueMap.get(aColumnName));
} else{
m1Buffer.append("'");
m1Buffer.append(pValueMap.get(aColumnName));
m1Buffer.append("'");
//System.out.println("Not Null values ARE*********" + pValueMap.get(aColumnName));
// do WHERE
if (pCondition != null)
m2Buffer.append(" WHERE ");
// this will normally be a key condition (one row updated at a time)
appendCondition(pCondition); // will add to "WHERE ..." clause
* builds a "delete" statement.
* @param pQualifierName
* @param pTableName
* @param pCondition
private void delete(String pQualifierName, String pTableName, AbstractEntityCondition pCondition)
m1Buffer.append("DELETE FROM ").append(QualifyTableName(pQualifierName, pTableName));
// do WHERE
if (pCondition != null)
m2Buffer.append(" WHERE ");
// this will normally be a key condition (one row deleted at a time)
appendCondition(pCondition); // will add to "WHERE ..." clause
* will get and save a unique (to this statment) correlation name of the given table
* to be used in the WHERE clause. This is in case the same table joined to
* more than once in the same query.
* @param pTableName
* @return
private String getCorrelationName(String pTableName)
String aCorrelationName = pTableName;
while (mReferenceSet.contains(aCorrelationName))
aCorrelationName = aCorrelationName + "_OTHER";
mReferenceSet.add(aCorrelationName);
return aCorrelationName;
* will prepend the qualifier (if any) to the table name.
* @param pQualifierName
* @param pTableName
* @return
private static String QualifyTableName(String pQualifierName, String pTableName)
return (pQualifierName == null ? "" : pQualifierName + ".") + pTableName;
* will make the given table the current table for parts of the expression below the current node.
* This is used anytime a join is needed.
* @param pQualifierName
* @param pTableName
private void pushTable(String pQualifierName, String pTableName)
String aCorrelationName = getCorrelationName(pTableName);
String aTableDeclaration = QualifyTableName(pQualifierName, pTableName) + " " + aCorrelationName;
m1Buffer.append(m1Buffer.length() == 0 ? " FROM " : ", ");
m1Buffer.append(aTableDeclaration);
mTableList.add(aTableDeclaration);
mTableStack.addFirst(aCorrelationName); // push
* will revert to the previous current table. This is used after a join is finished building.
private void popTable()
mTableStack.removeFirst(); // pop
* gets the table at the top of the stack.
* @return
private String getCurrentTable()
return (String) mTableStack.getFirst();
* will qualify the given column name with the name of the current table.
* @param pColumnName
* @return
private String QualifyColumnName(String pColumnName)
if (SELECT.equals(mStatementType))
return getCurrentTable() + "." + pColumnName;
return pColumnName;
* will qualify the column name and append it to the second buffer.
* @param pColumnName
private void appendColumn(String pColumnName)
m2Buffer.append(QualifyColumnName(pColumnName));
* will qualify the column name and append it to the second buffer, adding the "UPPER" function.
* @param pColumnName
private void appendColumnUpper(String pColumnName)
appendUpper();
appendOpening();
appendColumn(pColumnName);
appendClosing();
* will append "?" to the second buffer and add the value to the parameter list,
* or append "NULL" if the value is null.
* @param pValue
private void appendValue(Object pValue)
if (pValue == null)
m2Buffer.append("NULL");
else
m2Buffer.append("?");
mParameterList.add(pValue);
* will append "?" to the second buffer and add the upper-cased value to the parameter list,
* or append "NULL" if the value is null.
* @param pValue
private void appendValueUpper(Object pValue)
appendValue(null == pValue ? null : pValue.toString().toUpperCase());
* will append the condition to the statement. This initiates a series of calls that walks
* the expression tree and builds the SQL accordingly by calls back to methods of this class.
* @param pCondition
private void appendCondition(AbstractEntityCondition pCondition)
pCondition.buildPredicate(this);
* appends a true condition.
private void appendTrue()
m2Buffer.append("1=1");
* appends a false condition.
private void appendFalse()
m2Buffer.append("1=0");
* appends an opening parenthesis.
private void appendOpening()
m2Buffer.append("(");
* appends a closing parenthesis.
private void appendClosing()
m2Buffer.append(")");
* appends "is null".
private void appendIsNull()
m2Buffer.append(" IS NULL");
* appends "is not null".
private void appendIsNotNull()
m2Buffer.append(" IS NOT NULL");
private void appendAnd()
m2Buffer.append(" AND ");
private void appendOr()
m2Buffer.append(" OR ");
private void appendNot()
m2Buffer.append("NOT ");
private void appendLike()
m2Buffer.append(" LIKE ");
private void appendBetween()
m2Buffer.append(" BETWEEN ");
private void appendEqualTo()
m2Buffer.append(" = ");
private void appendNotEqualTo()
m2Buffer.append(" <> ");
private void appendLessThan()
m2Buffer.append(" < ");
private void appendLessThanOrEqualTo()
m2Buffer.append(" <= ");
private void appendGreaterThan()
m2Buffer.append(" > ");
private void appendGreaterThanOrEqualTo()
m2Buffer.append(" >= ");
* appends the upper-casing function.
private void appendUpper()
m2Buffer.append("UCASE");
* constructs the final SQL expression, builds a prepared statement with it,
* and fills the prepared statement with the parameter values.
* @param pConnection
* @return
* @throws SQLException
PreparedStatement generatePreparedStatement(Connection pConnection) throws SQLException
pConnection.setReadOnly(mIsReadOnly);
String sql = m1Buffer + " " + m2Buffer;
System.out.println("GENERATED SQL = ");
System.out.println(sql);
System.out.println("GENERATED SQL = ");
System.out.println(sql);
System.out.println("PARAMETER LIST = ");
System.out.println(mParameterList);
PreparedStatement aPreparedStatement = pConnection.prepareStatement(sql);
for (int i = 0; i < mParameterList.size(); i++)
aPreparedStatement.setObject(1 + i, mParameterList.get(i));
return aPreparedStatement;
* is an enumerated type.
private static final class StatementType extends AbstractType
private StatementType(String pType)
super(pType);
[i]package firstpro.persistence;
import multnomah.database.ConnectionPool;
import java.sql.*;
import java.util.Date;
import java.util.*;
* is the abstract base class for all generated entity classes.
* It encompasses all functionality not specifically tied to a given field.
public abstract class AbstractEntity
* contains all "open" entities in the system.
* This is to insure that two threads cannot update the same entity at the same time.
* It is a weak hash map, so that entries do not prevent garbage collection if something is left open.
static Map sOpenEntityMap = new WeakHashMap();
* is true when the entity represents a row in a table
boolean mIsBacked = false;
* is true when the entity is in a state that allows updating
boolean mIsMutable = false;
* contains the values that exist in the underlying row