Error using Replace funciton in java

Question

hi, i need to replace my ' in sql string with '' so that no problem will occur when i execute the sql statement. i tried strName.replace('\'','\'\'') and recieved an error message when i compile, saying that i have unclosed character literal. anyone can tell me what's wrong? thanks...

Answer 1

the replace function will only replace one character.
It can not swap one character for two,
If you have Java 1.4 you can do a replaceAll() function
However, I would recommend you look at using prepared statements rather than escaping yourself manually. It is less error prone in the long run.
ie
Instead of
String sql = "Select * from person where name = '" + person.getName() + "'";
Statement stmt = connection.createStatement();
stmt.executeQuery(sql);
do
String sql = "Select * from person where name = ?";
PreparedStatement stmt = connection.prepareStatement(sql);
stmt.setString(1, person.getName());