How to construct a sql query when field having single quote

Hi all,
I have been working on web application , here is my requirement:
I'm constructing sql statement dynamically from dynamic user input (form data). In one of the field having single quote.
while executing the query it is getting problem because of single quote .. so how do i resolve my problem.
single quote should be there. (I'm using Ms-Access as my database).
Thanks in advance
abel

Use PreparedStatement. Always. It not only eases setting Java objects in a SQL query, but also protects you against SQL injections.
Prepare yourself: [http://java.sun.com/docs/books/tutorial/jdbc/basics/prepared.html].

Similar Messages

  • How to execute an SQL query present in a string inside an ABAP program?

    hello,
    How to execute an SQL query present in a string inside an ABAP program

    Raut,
    You can execute Native SQl statements.
    Ex: To use a Native SQL statement, you must precede it with the EXEC SQL statement, and follow it with the ENDEXEC statement as follows:
    EXEC SQL [PERFORMING <form>].
      <Native SQL statement>
    ENDEXEC.
    There is no period after Native SQL statements. Furthermore, using inverted commas (") or an asterisk (*) at the beginning of a line in a native SQL statement does not introduce a comment as it would in normal ABAP syntax. You need to know whether table and field names are case-sensitive in your chosen database.
    In Native SQL statements, the data is transported between the database table and the ABAP program using host variables. These are declared in the ABAP program, and preceded in the Native SQL statement by a colon (:). You can use elementary structures as host variables. Exceptionally, structures in an INTO clause are treated as though all of their fields were listed individually.
    If the selection in a Native SQL SELECT statement is a table, you can pass it to ABAP line by line using the PERFORMING addition. The program calls a subroutine <form> for each line read. You can process the data further within the subroutine.
    As in Open SQL, after the ENDEXEC statement, SY-DBCNT contains the number of lines processed. In nearly all cases, SY-SUBRC contains the value 0 after the ENDEXEC statement. Cursor operations form an exception: After FETCH, SY-SUBRC is 4 if no more records could be read. This also applies when you read a result set using EXEC SQL PERFORMING.
    EXEC SQL PERFORMING loop_output.
      SELECT connid, cityfrom, cityto
      INTO   :wa
      FROM   spfli
      WHERE  carrid = :c1
    ENDEXEC.
    Pls. Mark If useful

  • How to tune past SQL query??

    Hi Team,
    Straight to issue --> I am seeing an query running for long time. When i begun to trace that particular query it got over by the time and now how to trace that specific SID and QUERY..
    I am working on 10.2.0.4 version DB..
    How to trace an sql query after its execution?? pls provide steps how to begin with..
    regards
    dkoracle

    dkoracle wrote:
    Hi Team,
    Straight to issue --> I am seeing an query running for long time. When i begun to trace that particular query it got over by the time and now how to trace that specific SID and QUERY..
    I am working on 10.2.0.4 version DB..
    How to trace an sql query after its execution?? pls provide steps how to begin with..Can not be done.
    ALTER SESSION SET SQL_TRACE=TRUE;
    -- run query again

  • How to view the sql query?

    hi,
      how to view the sql query formed from the xml structure in the receiver jdbc?

    You can view SAP Note at
    http://service.sap.com/notes
    But you require SMP login ID for this which you should get from your company. The content of the notes are as follows:
    Reason and Prerequisites
    You are looking for additional parameter settings. There are two possible reasons why a feature is available via the "additional parameters" table in the "advanced mode" section of the configuration, but not as documented parameter in the configuration UI itself:
    Category 1: The parameter has been introduced for a patch or a SP upgrade where no UI upgrade and/or documentation upgrade was possible. In this case, the parameter will be moved to the UI and the documentation as soon as possible. The parameter in the "additional parameters" table will be deprecated after this move, but still be working. The parameter belongs to the supported adapter functionality and can be used in all, also productive, scenarios.
    Category 2. The parameter has been introduced for testing purposes, proof-of-concept scenarios, as workaround or as pre-released functionality. In this case, the parameter may or may not be moved to the UI and documentation, and the functionality may be changed, replaced or removed. For this parameter category there is no guaranteed support and usage in productive scenarios is not supported.
    When you want to use a parameter documented here, please be aware to which category it belongs!
    Solution
    The following list shows all available parameters of category 1 or 2. Please note:
    Parameter names are always case-sensitive! Parameter values may be case-sensitive, this is documented for each parameter.
    Parameter names and values as documented below must be used always without quotaton marks ("), if not explicitly stated otherwise.
    The default value of a parameter is always chosen that it does not change the standard functionality
    JDBC Receiver Adapter Parameters
    1. Parameter name: "logSQLStatement"
                  Parameter type: boolean
                  Parameter value: true for any string value, false only for empty string
                  Parameter value default: false (empty String)
                  Available with: SP9
                  Category: 2
                  Description:
                  When implementing a scenario with the JDBC receiver adapter, it may be helpful to see which SQL statement is generated by the JDBC adapter from the XI message content for error analysis. Before SP9, this can only be found in the trace of the JDBC adapter if trace level DEBUG is activated. With SP9, the generated SQL statement will be shown in the details page (audit protocol) of the message monitor for each message directly.
                  This should be used only during the test phase and not in productive scenarios.
    Regards,
    Prateek

  • How to get physical SQL query

    Hi All,
    How to get the physical SQL query for the OBIEE reports.
    Thanks in advance,
    Haree.

    Hi Anitha,
    Thanks for your reply,
    I am getting XML script in log file. (Settings > Administration > Manage Sessions > View Log).
    How to get physical SQL query ?
    Thanks,
    Haree

  • How to write a SQL query in SAP B1 2007 B with input parameters?

    How to write a SQL query in SAP B1 2007 B with input parameters, on execution of which will ask for some input value from the user and the values will be selected from a list such as item list?

    The syntax like
    SELECT * FROM OITM T0 WHERE T0.ItemCode = '[%0\]'
    Thanks,
    Gordon

  • How to execute this SQL Query in ABAP Program.

    Hi,
    I have a string which is the SQL Query.
    How to execute this sql Query (SQL_STR) in ABAP Program.
    Code:-
    DATA: SQL_STR type string.
    SQL_STR = 'select * from spfli.'.
    Thanks in Advance,
    Vinay

    Hi Vinay
    Here is a sample to dynamically generate a subroutine-pool having your SQL and calling it.
    REPORT dynamic_sql_example .
    DATA: BEGIN OF gt_itab OCCURS 1 ,
    line(80) TYPE c ,
    END OF gt_itab .
    DATA gt_restab TYPE .... .
    DATA gv_name(30) TYPE c .
    DATA gv_err(120) TYPE c .
    START-OF-SELECTION .
    gt_itab-line = 'REPORT generated_sql .' .
    APPEND gt_itab .
    gt_itab-line = 'FORM exec_sql CHANGING et_table . ' .
    APPEND gt_itab .
    gt_itab-line = SQL_STR .
    APPEND gt_itab .
    gt_itab-line = 'ENDFORM.' .
    APPEND gt_itab .
    GENERATE SUBROUTINE POOL gt_itab NAME gv_name MESSAGE gv_err .
    PERFORM exec_sql IN PROGRAM (gv_name) CHANGING gt_restab
    IF FOUND .
    WRITE:/ gv_err .
    LOOP AT gt_result .
    WRITE:/ .... .
    ENDLOOP .
    *--Serdar

  • How Can I find SQL Query in Database

    Dear Experts,
    How Can I find SQL Query in Database.

    Hi,
    U mena what query got executed in db? u can try V$SQL for it.
    Regards
    Bharath

  • How to set fetchsize of sql Query when using Database Adapter.

    Hi All,
    I am using DatabaseAdapter to connect to database and retriving huge amount of data.For improvement in the performance I want to set the "fetchsize" of sql query. I know fetchsize can be preset in Java using Jdbc 2.0 API.Please let me know how to set this value in BPEL when using DBAdapter?
    Thanks
    Chandra

    I talked to the developer of the db adapter - and he told me this feature will be available in BPEL PM 10.1.3 (which is supposed to be production later this year, and a public beta soon). If this is an emergency I would recommend going throug Oracle support and have them file an enhancement for 10.1.2.0.2
    hth clemens

  • Kodo 3.4.1: how to limit # of sql query params when using collection param

    Hi,
    We have a problem when using Kodo 3.4.1 against SQL Server 2005, when we execute query:
              Query query = pm.newQuery( extent, "IdList.contains( this )" );
              query.declareParameters( "Collection IdList" );
              query.declareImports( "import java.util.Collection;" );
              return (List) query.execute( list );
    We got:
    com.microsoft.sqlserver.jdbc.SQLServerException: The incoming tabular data stream (TDS) remote procedure call (RPC) protocol stream is incorrect. Too many parameters were provided in this RPC request. The maximum is 2100.
    at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(Unknown Source)
    at com.microsoft.sqlserver.jdbc.SQLServerStatement.getNextResult(Unknown Source)
    at com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement.doExecutePreparedStatement(Unknown Source)
    at com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement$PrepStmtExecCmd.doExecute(Unknown Source)
    at com.microsoft.sqlserver.jdbc.TDSCommand.execute(Unknown Source)
    at com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(Unknown Source)
    at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeCommand(Unknown Source)
    at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeStatement(Unknown Source)
    at com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement.executeQuery(Unknown Source)
    at com.solarmetric.jdbc.DelegatingPreparedStatement.executeQuery(DelegatingPreparedStatement.java:354)
    at com.solarmetric.jdbc.PoolConnection$PoolPreparedStatement.executeQuery(PoolConnection.java:341)
    at com.solarmetric.jdbc.DelegatingPreparedStatement.executeQuery(DelegatingPreparedStatement.java:352)
    at com.solarmetric.jdbc.LoggingConnectionDecorator$LoggingConnection$LoggingPreparedStatement.executeQuery(LoggingConnectionDecorator.java:1106)
    at com.solarmetric.jdbc.DelegatingPreparedStatement.executeQuery(DelegatingPreparedStatement.java:352)
    at kodo.jdbc.runtime.JDBCStoreManager$CancelPreparedStatement.executeQuery(JDBCStoreManager.java:1730)
    at com.solarmetric.jdbc.DelegatingPreparedStatement.executeQuery(DelegatingPreparedStatement.java:339)
    at kodo.jdbc.sql.Select.execute(Select.java:1581)
    at kodo.jdbc.sql.Select.execute(Select.java:1533)
    at kodo.jdbc.runtime.SelectResultObjectProvider.open(SelectResultObjectProvider.java:102)
    at com.solarmetric.rop.EagerResultList.<init>(EagerResultList.java:22)
    at kodo.query.AbstractQuery.execute(AbstractQuery.java:1081)
    at kodo.query.AbstractQuery.executeWithArray(AbstractQuery.java:836)
    at kodo.query.AbstractQuery.execute(AbstractQuery.java:799)
    It seems that there're too many ids in the list, and Kodo didn't limit the # of sql parameters when craft the sql query. Is there a way to ask Kodo to use multiple queries with smaller # of sql parameters instead of using one big sql query?
    Thanks

    Hi,
    Sadly, there is no way to do that in Kodo currently. The closest is the inClauseLimit DBDictionary setting, but that setting just breaks things up into multiple IN statements put together with an OR clause. In your case, it looks like the network transport, not the SQL parser, is complaining about size limits.
    You could force the query to run in-memory, but that would probably be prohibitively slow, unless the data set that you're querying against is relatively small.
    -Patrick

  • How to run a sql query from a button in apex 3.0

    Hi,
    I am brand new and went through/installed the obe project tracker. I have need to create a simple application that displays a result (2 fields, name and license number) based on two parameters (dob and login id) which all are stored in 1 table in the database. I could this very simply in VB or VB.net but have no idea how to do it in apex.
    Please provide guidance,
    Thank you,
    Tom

    Hi Tom,
    Sounds like a report region will satisfy your requirements.
    Create a new report region on one of your pages.
    Choose SQL Report and give the region a title.
    When you get to the "Enter SQL Query or PL/SQL function returning a SQL Query:" step, type:
    SELECT name, license_number
    FROM   <insert_your_table_name_here>
    WHERE  dob = :P<n>_dob
    AND    login_id = :P<n>loginid(replace <n> with the page number that the region is on and use your own table name).
    Don't try to run the page yet - it will give 'No data found'
    Now, go back to the Page Definition screen and add two items in the region you just created - call them P<n>dob and P<n>login_id
    Then, create a button in the same region (to be displayed amongst the region's items) - call it P<n>_GO and click 'Create' (take all the other defaults).
    Now you can run the page, put some values into the fields and click go.
    If you want to get fancier, you can change the text items to select lists etc. - let us know if you need help with that.
    Hope this helps,
    Bryan.

  • How to force an automatic query when first accessing a form?

    I have several forms on different tabs. When the first is queried, I save the key field. When the other forms start, they get the key with wwsto_api_session.load_session and store it in the form A_key.
    I want to have already performed a query when the user goes to the tab with the form on it. Can this be done? Is there a way to call doQuery from PL/SQL code?
    Gary

    Hello flöle,
    >>How can we prevent that and force the application to crash immediately when the unmanaged component fails?
    In my experience, this mechanism for wrapping the unmanaged expcetion should be by desiged since the .NET does not know these exception type. For handling unmanaged exception, the .NET provides a specific class:
    SEHException Class which is used to to handle unmanaged code exception in our managed code:
    https://msdn.microsoft.com/en-us/library/system.runtime.interopservices.sehexception.aspx
    You could use this class to catch the unmanaged exception.
    Regards.
    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click
    HERE to participate the survey.

  • How to execute a SQL  Query in Ms-Access

    Hi,
    I've a query which fetches the data from the tables based on daily transactions.
    I mean, the data gets updated daily basis.
    Now, i want to send the user a Ms-access work sheet with the query written, so that when ever the query is executed, it would fetch the records (with latest updates).
    I found some documents in google to, how to write sql query in ms-access.
    How ever, i'm unable to find the connection setup.
    how do i connect to oracle database using ms-access??
    Can any one please help me regarding this.
    Thanks,
    Santhosh

    You can try this tutorials
    http://www.reo.gov/gis/tools/infobase/LinkAccessToOracle.pdf
    Basically steps include,
    Install and configure Oracle client
    Configure ODBC DSN using correct TNS name configured in first step
    Link the table from Msaccess, make sure you linked the table not import it.

  • How to get an sql query result to a textbox?

    i am working with jdk1.4 and office 2003.
    i need to run the following SQL Query: "SELECT max(BookId) as BookId FROM Books" where BookId is an autonumeric generated number obtained from the field autonumber in access 2003 database.
    now, the result of this must be placed in a textbox.
    does anyone knows how to do this?
    I ve tried this but nothing happens and niether any error comes
    st = con.createStatement ();     //Creating Statement Object.
    long bookNo;          //Use for Comparing the Book's Id.
    try {     //SELECT Query to Retrieved the Record.
    String q = "SELECT max(BookId) as BookId FROM Books";
    ResultSet rs = st.executeQuery (q);     //Executing the Query.
    bookNo = rs.getLong ("BookId");          //Storing the Record.
    bookNo =(bookNo+1);
    txtBookId.setText (""+bookNo);
    catch (SQLException sqlex) { }
    does anyone knows how to do this?????plz help me out.
    Thanks
    Aanchal

    Hi Aanchal,
    If an SQL error occurs now, you cannot see it in your code. You should do something with the exception you catch, e.g. printing it: sqlex.printStackTrace(), so that you can see if something goes wrong.
    For your number, you should move the cursor in the resultset to the first row - either by: calling first( ) or next ( ), then you can retrieve your booknumber.
    Best Regards,
    Martijn

  • How to run recordset SQL query in FORM DATA event

    How can I run recordset SQL query in FORM DATA event upon clicking on Add button in the document?

    Hi Slamet,
    When you receive a form data event you have a class containing inside it a ObjectKeys xml info regarding the object added/modified,...
    With the objects keys you can then use the DI API method called GetByKeys to obtain the DI Object.
    There is some information about it in the SDK Help file, mainly in the "FormDataEvent" class definition:
    <i>The event provides the unique ID (BusinessObjectInfo.ObjectKey) of the modified business object. You can use the value of this property as an input parameter in the DI API DataBrowser.GetByKeys method to get a DI object.</i>
    Pay attention you don't have this information in the Before=True event of the Add as it is not yet in the database.
    Hope it helps
    Trinidad.

Maybe you are looking for