Escaping single quotes

Question

I didn't write the original database access/pooling code for this web app, and right now we've got an issue with single quotes in data not being escaped properly. I've read that PreparedStatement takes care of this for you, but I've only started using it for a few CLOB/BLOB inserts, etc, since we started converting to Oracle. Right now, the majority of our updates run through the following method, and this method gets called 45 times in our code:
public boolean runQuery(String query) {
   boolean runsuccess = false;
   PooledConnection Con = null;
   Statement Stmt = null;
   try {
     Con = oPool.getConnection();
     Stmt = Con.createStatement();
     Stmt.execute(query);
     runsuccess = true;
     Stmt.close();
   } catch(SQLException sqlerr) {
     if(Stmt != null) {
       try {
         Stmt.close();
       catch(SQLException err) {}
     System.out.println("SQL Error in DBACCESS 1: " + sqlerr + " Running Query: " + query);
     runsuccess = false;
   finally {
     if(Con != null) {
       oPool.returnConnection(Con);
   return runsuccess;
}It seems like a quick and dirty but decent short-term solution could be to just change this to use a PreparedStatement (without any parameters). I don't have much time at the moment, and we just need something that will work without introducing other issues. While I'm at it, should I also change the following method that is used for the majority of our reads (SELECTs) out of the database?
public synchronized ResultSet loadValues(String query) {
   try {
     loadCon = oPool.getConnection();
     loadStmt = loadCon.createStatement();
     RS = loadStmt.executeQuery(query);
   catch(SQLException sqlerr) {
     closeCon();
     System.out.println("Error Running SQL: " + sqlerr + " Running Query: " + query);
     sErrTxt = sqlerr.toString();
   return RS;
}Thanks for the advice...

Answer 1

Stephen,
As you were told in the reply you got to this same question that you posted to the JavaRanch forum (<- that's a link: click on it to go to your "JavaRanch" posting), merely replacing "Statement" with "PreparedStatement" will not help.
From the code you have posted, it looks like the "runQuery()" method is for performing DML (deletes, inserts and updates), while the "loadValues()" method is for fetching data from the database.
I believe the best solution will be to take the time to refactor your code. While I don't know any details of your situation (because you didn't provide any :-), taking the time to refactor the code properly will usually save you lots more time in the future.
For what it's worth, our generic version of your "runQuery()" method is this:
public int executeUpdate(String sql, Object[] params, int[] types)where "sql" contains "?" (question-mark) characters, "params" holds the values for the "?" parameters, and "types" holds the (SQL) data types for the "?" parameters (in case you want to assign null to any of the "?" parameters). The method creates a "PreparedStatement" and uses the "setXXX()" methods (in "PreparedStatement") -- as well as the "setNull()" method (if necessary) -- to assign values to the "?" parameters. It returns the value returned from "PreparedStatement.executeUpdate()" -- the number of rows affected.
Similarly, our equivalent to your "loadValues()" method is:
public ResultSet executeQuery(String sql, Object[] params, int[] types)This means changing the API, which means changing all the code that invokes these methods, but again, I would suggest that the time spent doing this now will save you lots of time in the long run.
Good Luck,
Avi.