Binding parameter to SQL/xpath query using java/jdbc

Question

I'm trying to execute a query containing an xpath.
The query looks like this:
select * FROM table  t where t.column.existsNode('/RootElement[contains(SubElement, "someVal")]/SubElement')In java replacing the "someVal" with a bind parameter "?" will not work:
PreparedStatement ps = c.prepareStatement("select * FROM table t where t.column.existsNode('/RootElement[contains(SubElement, ? )]/SubElement') = 1");
ps.setString(1,"someVal");
=EXCEPTIONOn this forum I found that you can also use '||:namedParam||'
So the query in java would be executed like;
PreparedStatement ps = c.prepareStatement("select * FROM table t where t.column.existsNode('/RootElement[contains(SubElement, '||:1||' )]/SubElement') = 1");
ps.setString(1,"someVal");This seems to work (I have no idea what the '|| ||' construct does, I don't seem to find any info about it)
HOWEVER, it seems that doing it this way the value being bound is NOT escaped.
So, doing this will yield in an orcale SQL/xpath exception:
ps.setString(1,"som'eVal");
I've went to all the oracle xml manual stuff I could find, but nowhere do they address this.
Any one an idea how I can bind the value and still have escaping ?
Edited by: user5893566 on Nov 27, 2008 12:06 AM
Edited by: user5893566 on Nov 27, 2008 12:15 AM

Answer 1

Would you mind explain me what the replace actually does?The idea is like this:
Let's start with a string like some'V"al and surround it by the concat function:
  '...concat("' || some'V"al || '") ....' {code}
replace the inner (i.e. all) double quotes with +",''","+ to obtain '...concat("' || some'V",''"'',"al || '") ...' {code}
So this concatenates three parts of the original string where the double quotes are now enclosed by two single quotes. The resulting string should look like
{code} '...concat("some'V",''"'',"al") ...'i.e. first argument of concat is enclosed by double quotes, the second one by two single quotes and the third one again by double quotes.  This is just a rewritten form of our original string!.
Now incorporate the whole thing in the xpath expression  as shown in my previous example and it should work ;)
hth
michael