Escaping input paramters for Oracle

Question

Hi all,
I am calling a stored procedure in Oracle and passing in one parameter as a string. The value is coming from the URL query string, a jsp is doing a request.getparameter and a method is called that handles the Oracle connectivity and stored procedure call.
I'm looking for a way to make sure that any characters that need to be escaped, like a single quote ('), are escaped before being passed to the stored procedure. Is there a Java function that will do this? Can the EncodeURL method be used here?
Thanks

Answer 1

Here's a little more information on my code. I am using a CallableStatement with a conn.prepareCall method:
CallableStatement cs = null;
String proc = "BEGIN DCUSTID(?,?);END;";
cs = conn.prepareCall(proc);
cs.setString(1, sCustID);
cs.registerOutParameter(2,java.sql.Types.NUMERIC);
cs.execute();
Can I use the prepareStatement() method in place of my prepareCall() if I change the cs parameter above to Statement stmt? If so, will this automatically handle any necessary escaping?
Thanks