Insering Items with ' into a DB!

Question

Hello all:
I am facing a tiny problem. I have a string to Insert into the database. The string contains a '. (say today's).
Class.forName(driver_name).newInstance();
Connection connectiondB = DriverManager.getConnection("jdbc:odbc:DBASE");
Statement statementdB = connectiondB.createStatement();
int j = statementdB.executeUpdate("INSERT into Table1 values('"+value1+"','"+value2+"')");
Suppose these are the values for a particular case...
value1 = today's
value2 = XYZ
If I'm not wrong this is the way we insert values into a DBase!
When I execute it for a value which is today's...it throws an exception
java.sql.SQLException: [Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression ' 'today's','XYZ')'.
Any ideas of what I can do to prevent this!
Thanks in advance
Prashanth

Answer 1

use PreparedStatement:
Class.forName(driver_name).newInstance();
Connection connectiondB = DriverManager.getConnection("jdbc:odbc:DBASE");
PreparedStatement statementdB = connectiondB.prepareStatement("INSERT into Table1 values(?, ?)");
statementDB.setString(1, "today's");
statementDB.setString(2, "XYZ");
int j = statementdB.executeUpdate();
Something like that.
Scott