Problems witth sql query from servlet

Question

hi,
I have a servlet that accesses a MySql database to get the ID of an employee based on employee name (grabbed from session). My problem is that :
empName contains a whitespace (String empName ="abc xyz")
When I try to give this to the query:
String query ="select id from user where eName =" +empName;
Now I keep getting a "SQL syntax error:please check your syntax to use near 'xyz' at line 1." here which I think is because of the white space in the empName. ( I tried dummy empName without spaces).
How do I get around this ..I cannot keep the names in the database without any space since they are being dislpayed in other pages. I tried doing a trim() on the empName before passing it to the sql query but I keep getting the same error.
Is there any way I could query the DB with a white space in the empName?
Thanks,
G.
Is there any way to

Answer 1

Second of all: Use prepared statements:
like:
insertStatement = "SELECT ? FROM ? WHERE name=?";                    
stmnt = _sql_connection.prepareStatement(insertStatement);
stmnt.setString(1, "name");
stmnt.setString(2, "table");
stmnt.setString(3, "test");This is more secure. If you do it the above way i could enter some thing like
*; DROP TABLE *; --
You dont want a user to kill your whole db, dont you?
so your querry String query ="select  id from user where eName = '" +empName +"'"; will end up:
select  id from user where eName = '*'; DROP TABLE *; -- 'where everything after -- is ignored because this is a comment flag.