Query with Apostrophe (single quote)

Hi all,
I have noticed that when you enter a search string with an apostrophe (eg. Tito's Station) in a textbox on a form linked to a table and hit the Query button, it generates an sql error. I think this is cos u cannot have an apostrophe (single quote) in the search string in a "where" clause.
I am using Portal version 3.0.6.6.5 on an 8.1.7 database.
I have logged a tar (1744105.999) for this but it is said to be a bug (1759202). I wish to enquire whether any of you have had this problem with a later version or at which version leve this bug has been fixed.
Does any1 know how to limit the text typed into a texbox, so that it wont accept certain characters (eg. the apostrophe key) ??
Thanks

Hi Rene'
Thanks for your help! This will definitely help me alot! I am a little baffled with your code for delimiting the single quote. I tried it and it doesnt work.
Thanks very much for the response
Naseem
<BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:</font><HR>Originally posted by Rene' Castle ([email protected]):
This is still an issue in 3.0.8.9.8. You can use a Javascript validation routine to disallow special characters.
If you want to check to see that they only enter certain things you can do:
var s = theElement.value;
var filter=/^[a-zA-Z]{1,}$/;
if (s.length == 0 ) return true;
if (filter.test(s))
return true;
else
alert(" Please input a valid character" );
theElement.focus();
theElement.select();
return false;
The above code would only allow one or more alphabetic characters. You could make it [a-zA-Z0-9] to allow alphanumeric characters. You could also allow anything but specific characters by doing the following:
var s = theElement.value;
var filter=/[^']*/;
if (s.length == 0 ) return true;
if (filter.test(s))
alert(" Please input a string without a single quote (') in it" );
theElement.focus();
theElement.select();
return false;
else
return true;
Hope this gets you started.
Rene'<HR></BLOCKQUOTE>
null

Similar Messages

  • JSF inputText takes apostrophe (single quote) as end of string

    Hi,
    I run into a problem with JSF when apostrophe(single quote) is in input text:
    <h:inputText id="input1" styleClass="field" size="20" maxlength="20" value="#{bean.property1}" />
    When user inputs string contains apostrophe (single quote), for example "John's task", the bean only gets "John". The text after the apostrophy is gone. It seems that the inputText takes apostrohe as end of the string.
    I also test with escaple sequence, for example, input is "John\' task", the result in bean is still "John"
    input is "John\\\' task", the result in bean is "John
    It doesn't have problem with other special characters, such as "<">", "@" , double quote etc.
    Finally, I fix the problem by replacing apostrohy with "& # 0 3 9".
    I just wonder if anyone has similar prolbem and wehether this is some bug in certain version of JSTL or some configuration issue ( for example, some definittion for end of the string in some config file, etc).
    Your insight is appreciated.
    Thanks

    Without the actual code we can't be of any meaning for you. Create a small reprocudeable test case and post the actual code here. For example:
    JSF<%@ taglib uri="http://java.sun.com/jsf/html" prefix="h" %>
    <%@ taglib uri="http://java.sun.com/jsf/core" prefix="f" %>
    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
    <f:view>
        <html>
            <head>
                <title>test</title>
            </head>
            <body>
                <h:form>
                    <h:inputText value="#{myBean.value}" />
                    <h:commandButton value="submit" action="#{myBean.action}" />
                    <h:outputText value="#{myBean.value}" />
                </h:form>
            </body>
        </html>
    </f:view>MyBeanpackage mypackage;
    public class MyBean {
        private String value;
        public void action() {
            System.out.println(value);
        public String getValue() {
            return value;
        public void setValue(String value) {
            this.value = value;
    }faces-config:<faces-config>
        <managed-bean>
            <managed-bean-name>myBean</managed-bean-name>
            <managed-bean-class>mypackage.MyBean</managed-bean-class>
            <managed-bean-scope>request</managed-bean-scope>
        </managed-bean>
    </faces-config>Which works fine by the way.

  • SQL Injection, replace single quote with two single quotes?

    Is replacing a single quote with two single quotes adequate
    for eliminating
    SQL injection attacks? This article (
    http://www.devguru.com/features/kb/kb100206.asp
    ) offers that advice, and it
    enabled me to allow users to search name fields in the
    database that contain
    single quotes.
    I was advised to use "Paramaterized SQL" in an earlier post,
    but I can't
    understand the concept behind that method, and whether it
    applies to
    queries, writes, or both.

    Then you can use both stored procedures and prepared
    statements.
    Both provide better protection than simply replacing
    apostrophes.
    Prepared statements are simple:
    Set myCommand = Server.CreateObject("ADODB.Command")
    ...snip...
    myCommand.CommandText = "INSERT INTO Users([Name], [Email])
    VALUES (?, ?)"
    ...snip...
    myCommand.Parameters.Append
    myCommand.CreateParameter("@Name",200,1,50,Name)
    myCommand.Parameters.Append
    myCommand.CreateParameter("@Email",200,1,50,Email)
    myCommand.Execute ,,128 'the ,,128 sets execution flags that
    tell ADO not to
    look for rows to be returned. This saves the expense of
    creating a
    recordset object you don't need.
    Stored procedures are executed in a similar manner. DW can
    help you with a
    stored procedure through the "Command (Stored Procedure)"
    server behavior.
    You can see a full example of a prepared statement by looking
    at DW's
    recordset code after you've created a recordset using version
    8.02.
    "Mike Z" <[email protected]> wrote in message
    news:eo5idq$3qr$[email protected]..
    >I should have repeated this, I am using VBScript in ASP,
    with an Access DB.
    >

  • How to pass presentation variable with enclosing single quotes

    HI All,
    As all of you know in 11g, Presentation variable can hold more than one value.So we can pass multiple values to the report through presentation variable.
    If we select x,y,z values from prompt drop down,then those values will be stored like x,y,z in the presentation variable.
    but I would like to store these values with enclosing single quotes like 'x,y,z'
    The reason is I need to pass this variable value as input to BI Publisher sql dataset query where clause.
    Please share your Ideas.
    Thanks,
    Aravind

    Aravind,
    Check this
    Predefined Presentation Variables in OBIEE 11G | Praveen&amp;#039;s Blog

  • Jstl inputText takes apostrophe (single quote) as end of string

    Hi,
    I run into a problem with jstl when apostrophe(single quote) is in input text:
    <h:inputText id="input1" styleClass="field" size="20" maxlength="20" value="#{bean.property1}" />
    When user inputs string contains apostrophe (single quote), for example "John's task", the bean only gets "John". The text after the apostrophy is gone. It seems that the inputText takes apostrohe as end of the string.
    I also test with escaple sequence, for example, input is "John\' task", the result in bean is still "John"
    input is "John\\\' task", the result in bean is "John\\".
    It doesn't have problem with other special characters, such as "<".">",""", "@" etc.
    Finally, I fix the problem by replacing apostrohy with "&#039;".
    I just wonder if anyone has similar prolbem and wehether this is some bug in certain version of JSTL or some configuration issue ( for example, some definittion for end of the string in some config file, etc).I'm using JSTL 1.1.1.2.
    Your insight is appreciated.
    Thanks

    This isn't JSTL, it's JSF. There's a separate forum for this: http://forum.java.sun.com/forum.jspa?forumID=427
    I think the escape character for a single quote is the single quote itself. Give that a shot.
    People on the forum help others voluntarily, it's not their job.
    Help them help you.
    Learn how to ask questions first: http://faq.javaranch.com/java/HowToAskQuestionsOnJavaRanch
    (Yes I know it's on JavaRanch but I think it applies everywhere)
    ----------------------------------------------------------------

  • How to replace double quotes with a single quote in a string ?

    Hi All:
    Can some one tell me how to replace double Quote (") in a string with a single quote (') ? I tried to use REPLACE function, but I couldn;t get it worked.
    My example is SELECT REPLACE('STN. "A"', '"', ''') FROM Dual --This one throws an error
    Thanks,
    Dima.

    Whether it is maybe not the more comfortable way, I like the quoting capabitlity from 10g :
    SQL> SELECT REPLACE('STN. "A"', '"', q'(')') FROM Dual;
    REPLACE(
    STN. 'A'{code}
    Nicoals.                                                                                                                                                                                                                                                                                                                                                                                                                                       

  • Apostrophes (single quote) are lost when generating DDL code.

    Hi,
    ODI Version : 11.1.1.5.0
    Java version : 1.6.0_24
    Database version : Oracle Database 11g Enterprise Edition Release 11.2.0.2.0 - 64bit Production
    Context: Generating DDL code for a an ODI Model
    PROBLEMATIC: When generating DDL code, all apostrophes (single quote: ') are removed from Datastore Descriptions and Datastore Colunms Descriptions in the process of generating Comments on Tables and Comments on Tables Columns. I tried to double, even triple apostrophes (in descriptions), without success. I also tried double quotes (") without success either.
    Ex: Datastore Column Description: *+ID de l'utilisateur+* becomes *+comment on table ... is 'ID de l utilisateur'+* in generated procedure.
    Do you know a way to keep the apostrophes when creating Comments on Columns and Oracle Tables by generating DDL code ?
    Regards,
    Gaston
    Edited by: uleblga on 23-May-2012 3:42 PM
    Edited by: uleblga on 23-May-2012 3:42 PM

    Nobody has a clue as how to handle this problem ?
    Regards,
    Gaston

  • String with embedded single quote

    Hi, all. We're trying to pass a string from one procedure to another, which will then do an EXECUTE IMMEDIATE on it. However, there are single quotes withing the string, and they're driving us nuts! This is what the concatenated string should look like when passed to the pw_execDDL procedure:
    insert into appimmunization.wsrprfs (inoc_id, proof, is_valid,proof_num) values ('MEAG', to_date('02-OCT-05','DD-MMM-YY'), 'Y',1);
    Here's the concatenation process that doesn't work, and there are functions being called within the string:
    chr_sql := 'insert into appimmunization.wsrprfs (inoc_id, proof, is_valid,proof_num) values (' || '''' || prm_inoc_id || '''' || ', ' || 'to_date(' || '''' || prm_proof1 || ''''||','||'''' ||'DD-MMM-YY'||''''||')' || ', ' || '''' || fw_is_proof_valid(prm_birth_date, prm_proof1) || '''' || ',1);';
    pw_execDDL(chr_sql); /* call the procedure to do the EXECUTE IMMEDIATE */
    Help! We've tried every combination -- using two single quotes together, three, and four, and still no luck. Thanks.

    insert into appimmunization.wsrprfs (inoc_id, proof,
    is_valid,proof_num) values ('MEAG',
    to_date('02-OCT-05','DD-MMM-YY'), 'Y',1);
    This statement can be made in a string with the following affectation:
    chr_sql := 'insert into appimmunization.wsrprfs (inoc_id, proof, is_valid,proof_num) values (''MEAG'', to_date(''02-OCT-05'',''DD-MMM-YY''), ''Y'',1)';
    Note please that each single quote in your original string must be specified using two single quotes and that is all. It is more readable and more easy to do it this way.
    Michel.

  • REGEXP_LIKE help with literal single-quote

    I'm trying to write a check constraint to validate email addresses that may include an apostrophe in the email address. Such as joe.o'[email protected] Here is my sample setup:
    create table emails
    ( email_address varchar2(150)
    insert into emails values('[email protected]') ;
    insert into emails values('[email protected]') ;
    insert into emails values('joey.o''[email protected]') ;
    commit;
    sql> select * from emails;
    EMAIL_ADDRESS
    [email protected]
    [email protected]
    joey.o'[email protected]
    alter table emails add constraint email_address_format_ck
        CHECK ( REGEXP_LIKE ( email_address, '^[a-z0-9._%-]\'?+@[a-z0-9._%-]+\.mil$','c'));
    ERROR at line 2:
    ORA-00911: invalid characterIt doesn't like *\'?*
    My understanding is this means one or more single-quotes. Anyone know the correct syntax to accept apostrophes?

    Hi,
    jimmyb wrote:
    ... insert into emails values('joey.o''[email protected]') ;
    That's the correct way (actually, that's one correct way) to include a single-quote in a string literal: use 2 single-quotes in a row.
    ... alter table emails add constraint email_address_format_ck
    CHECK ( REGEXP_LIKE ( email_address, '^[a-z0-9._%-]\'?+@[a-z0-9._%-]+\.mil$','c'));Here, the 2nd argument to REGEXP_LIKE is a string literal, just like 'joey.o''[email protected]' was a string literal.
    To include a single-quote in the middle of this string literal, do the same thing you did before: use 2 of them in a row:
    CHECK ( REGEXP_LIKE ( email_address, '^[a-z0-9._%''-]+@[a-z0-9._%-]+\.mil$','c'));There were a couple of other problems, too.
    I'm sure you meant for the apostrophe to be inside the square brackets. Inside square brackets, \ does not function as an escape character. (Actually, single-quote has no special meaning in regular expressions, so there's no need to escape it anyway.)
    I'm not sure what the '?' mark was doing; I left it out.
    Of course, you'll have trouble adding the CHECK constraint if any existing rows violate it.
    Edited by: Frank Kulash on Feb 10, 2012 6:52 PM

  • Issue searching a content with a single quote in title using matches

    Hi,
    I'm trying to search a content which has a single quote in its title by using the following code:
    ISCSSearchAPI searchAPI = app.getUCPMAPI ().getActiveAPI ().getSearchAPI ();
    ISCSSearchQuery query = (ISCSSearchQuery)app.getUCPMAPI ().createObject (ISCSSearchQuery.class);
    query.setQueryText(queryText);
    ISCSSearchResponse response = searchAPI.search(scsContext, query);
    when the query text is: dDocTitle <matches> `What's New`
    an exception occurs:
    Unable to retrieve search results. Error occurred while retrying the search query. Error occurred while processing. Unable to return results.
    Exception in thread "main" com.stellent.cis.client.command.CommandException: Unable to retrieve search results. Error occurred while retrying the search query. Error occurred while processing. Unable to return results.
         at com.stellent.cis.server.api.scs.impl.SCSCommand.executeRequest(SCSCommand.java:338)
         at com.stellent.cis.server.api.scs.impl.SCSCommand.execute(SCSCommand.java:222)
         at com.stellent.cis.client.command.impl.services.CommandExecutorService.executeCommand(CommandExecutorService.java:57)
         at com.stellent.cis.client.command.impl.CommandFacade.executeCommand(CommandFacade.java:158)
         at com.stellent.cis.client.command.impl.BaseCommandAPI.invokeCommand(BaseCommandAPI.java:84)
         at com.stellent.cis.client.api.scs.search.impl.SCSSearchAPI.search(SCSSearchAPI.java:52)
         at com.guycarp.cm.service.ContentQueryService.search(ContentQueryService.java:133)
         at com.guycarp.cm.service.ContentQueryService.main(ContentQueryService.java:168)
    Caused by: com.stellent.cis.server.api.scs.request.SCSRequestException: Unable to retrieve search results. Error occurred while retrying the search query. Error occurred while processing. Unable to return results.
         at com.stellent.cis.server.api.scs.request.impl.SCSRequestProcessor.checkBinderForErrors(SCSRequestProcessor.java:357)
         at com.stellent.cis.server.api.scs.request.impl.SCSRequestProcessor.validateResponse(SCSRequestProcessor.java:273)
         at com.stellent.cis.server.api.scs.request.impl.SCSRequestProcessor.processRequest(SCSRequestProcessor.java:118)
         at com.stellent.cis.server.api.scs.request.impl.SCSRequestFilterChain.doRequestFilter(SCSRequestFilterChain.java:61)
         at com.stellent.cis.server.api.scs.request.stream.SCSOptimizedPublishFilter.handleRequest(SCSOptimizedPublishFilter.java:128)
         at com.stellent.cis.server.api.scs.request.impl.SCSRequestFilterChain.doRequestFilter(SCSRequestFilterChain.java:58)
         at com.stellent.cis.server.api.scs.request.stream.SCSOptimizedRetrieveFilter.handleRequest(SCSOptimizedRetrieveFilter.java:250)
         at com.stellent.cis.server.api.scs.request.impl.SCSRequestFilterChain.doRequestFilter(SCSRequestFilterChain.java:58)
         at com.stellent.cis.server.api.scs.request.rewrite.SCSRewriteURLFilter.handleRequest(SCSRewriteURLFilter.java:140)
         at com.stellent.cis.server.api.scs.request.impl.SCSRequestFilterChain.doRequestFilter(SCSRequestFilterChain.java:58)
         at com.stellent.cis.server.api.scs.request.cache.impl.SCSServiceCacheFilter.handleRequest(SCSServiceCacheFilter.java:104)
         at com.stellent.cis.server.api.scs.request.impl.SCSRequestFilterChain.doRequestFilter(SCSRequestFilterChain.java:58)
         at com.stellent.cis.server.api.scs.request.impl.SCSRequestExecutorProxy.execute(SCSRequestExecutorProxy.java:105)
         at com.stellent.cis.server.api.scs.impl.SCSCommand.executeViaProxy(SCSCommand.java:353)
         at com.stellent.cis.server.api.scs.impl.SCSCommand.executeRequest(SCSCommand.java:335)
    but the query text dDocTitle <contains> `What's New`
    works fine.
    Is there any escape character that I should be using for the single quote when we use <matches> operator?
    Facing the same issue when searching from the content server console.
    Any idea!
    Thanks,
    Anil

    There seems to be none OOTB, but you can define it, see http://docs.oracle.com/cd/E25054_01/doc.1111/e10792/c05_search.htm#CHDIEECF

  • Update with a Single Quote value

    how do i update a field containing a sigle quote in a record ?
    e.g :
    i have a table s_order_item_xa
    filed: attr_name
    old value: Noofndk
    new value: Noofn's
    how can i update above field value? i am using row_id in where condition to identify rows which i want to update.

    Hi,
    Is the question "How can I include a single-quote character in a string literal?", then the answer is to use 2 of them, like this:
    UPDATE  books
    SET     dewey_num = '291''.4'
    WHERE   dewey_num = '291.4'
    ;In Oracle 10 (and up) you can also use Q-notation. For example:
    UPDATE  books
    SET     dewey_num = Q'[291'.4]'
    WHERE   dewey_num = '291.4'
    ;Edited by: Frank Kulash on Sep 14, 2009 9:51 AM

  • Query with using single index

    I have what seems like a pretty straight forward problem. I have a table, say TAB_A that has a NAME, PHONE, SSN along with some other values (no primary key...I know, don't start with me. That's just the way it is.) I want to retrieve records where the NAME or the PHONE, or the SSN match a static value. I realize I could write this as:
    WHERE name = 'Joe' OR phone = '5556667777' or ssn = '012345678'
    However, when you do this (assuming there is a concatenated index on name, phone, ssn), you end up doing an index full scan. If you create three individual indexes on each column then you can write a union query that utilizes the index for each value...eg.
    select...
    where name = 'Joe'
    union
    select...
    where phone = '555667777'
    union
    etc.
    However, here you are writing three separate queries that each do an index range scan. I'm just wondering if there is some way to do this...say with some sort of function based index and a hashing algorithm applied to the data where I can do this in a single index range scan? Any ideas?

    I don't see how a single index entry can point to a row that doesn't exist (in all likelihood).
    Without testing it, I don't see how even a concatenated index could help.
    The rows returned by your query are completely unrelated (unless you find the one person who has all three).
    By the way, 7 posts in 10 years. Now that's what I call a lurker.

  • Report handling names with a single quote

    Report 10gR2
    I have created a report and most of the functionality that i want is working as expected.
    I have a report where i am letting user enter their first name on one field and last name on another field in the parameter screen ( thats how it's stored in the database)
    If they enter any name with an aphostrophe , say D'Costa ( either first name or last name)
    then i get the below error
    REP-50003: Bad parameter: pfaction=http://.........
    I am using like keyword as seen below in the afterparam trigger and passing the parameter :p_where_last_name to the main sql query
         :p_where_last_name := ' AND UPPER( :last_name) LIKE (' ||''''||'%'||UPPER(:last_name)||'%'||''''||')' ;
    Whats the best approach to handle this issue
    Also is there a way to capture this error
    ' REP-50003: Bad parameter: pfaction=http://.........
    ' and display a message, if so where and how, please advise.
    thanks.
    Edited by: Forms_Reports_Beginner on Aug 13, 2009 1:52 PM

    I am not using form , it's just done in report, that is i am not calling the report from a form , just from a menu.
    :last_name is a report_paramter that i created on the report.
    you're right the first assignmnt is
    AND UPPER( db column) LIKE
    I have a paramter form on the report with a field last name and I am letting the user enter last name there which gets stored in the :last_name
    Edited by: Forms_Reports_Beginner on Aug 14, 2009 7:29 AM
    Edited by: Forms_Reports_Beginner on Aug 14, 2009 7:32 AM
    Rodolfo,
    your solution works,
    :p_where_clause := ' AND UPPER( db_column ) LIKE (' ||''''||'%'||UPPER(Replace(:p_2,chr(39), chr(39)||chr(39)))||'%'||''''||')' ;
    but i dont quite understand how this is working
    Replace(:p_2,chr(39), chr(39)||chr(39))
    i have never used chr
    Edited by: Forms_Reports_Beginner on Aug 14, 2009 7:35 AM

  • How do I replace one ' (Single Quote) with '' (Two single Quote)

    Hi,
    I have been surfing around the forum, coudn't find the similiar case.
    I have been trying but fail. Below is my code:
    activity = request.getParameter("activity");
    activity = activity.replace("\'", "\'\'");
    Error Occur:
    Incompatible type for method. Can't convert java.lang.String to char. activity = activity.replace("\'", "\'");
    I'm trying to use replaceAll(), but seem like the method is not existed, we are using Version Java 1.3
    Pls advise.
    Regards
    Ying

    For JDK 1.3 or ealier, use this:
      public static String replaceSubstrings(String str, String sub, String rep){
        int s, p, q;
        int slen = sub.length();
        StringBuffer sb = new StringBuffer();
        s = 0;
        p = str.indexOf(sub);
        q = p + slen;
        while (p != -1){
          sb.append(str.substring(s, p));
          sb.append(rep);
          s = q;
          p = str.indexOf(sub, s);
          if (p != -1){
            q = p + slen;
        sb.append(str.substring(s));
        return sb.toString();
    activity = replaceSubstrings(activity, "'", "''");

  • Replace single quote with two single quotes

    Hi all,
    I have a value = ABCD'S(>@!23. i want to replace the value as ABCD''S(>@!23.
    Thanks in advance

    What is your database version ? Q operator works from 10G onwards.
    SQL*Plus: Release 10.2.0.1.0 - Production on Tue Nov 23 14:35:38 2010
    Copyright (c) 1982, 2005, Oracle.  All rights reserved.
    SQL> conn hr
    Enter password:
    Connected.
    SQL>  CREATE TABLE test_Q_operator(str VARCHAR2(30));
    Table created.
    SQL> INSERT INTO test_Q_operator VALUES('ABCD''S(>@!23');
    1 row created.
    SQL> INSERT INTO test_Q_operator VALUES('Saubhik''s test row');
    1 row created.
    SQL> commit;
    Commit complete.
    SQL> SELECT str,REPLACE(str,Q'[']',Q'['']') col2
      2  FROM test_Q_operator;
    STR
    COL2
    ABCD'S(>@!23
    ABCD''S(>@!23
    Saubhik's test row
    Saubhik''s test row
    SQL>Also check you SQL*PLUS client version.

Maybe you are looking for

  • Creation of sequence and trigger for each table!!!!!!!1

    Hi I am new to trigger and Sequence field. In one of my database we have many tables with fields for specifing ID numbers. Iam planning to insert the ID field with help of a Sequence and trigger...that trigger fires by adding the sequence value from

  • Print to xps-printer problem from Adobe Reader 11.0.06

    Steps to reproduce bug: 1. Add XPS printer (using new local port and Microsoft XPS Document Writer v4) 2. Open a pdf file in Adobe Reader XI (11.0.06.70) 3. Choose command Print 4. Choose XPS printer 5. Click print Results: nothing happend Expected r

  • Need to read image from scanner

    Hi, I wnat to load image from scanner directly into forms. Then save it into table. Shahin

  • Error while result recording

    Hi Friends, I have maintained a MIC as qualitative. I have maintained the selected set and codes for this. When i am trying to record results by QE51N i am getting an error "  Value can't be interp. as floating-point number or longer than 22 charac."

  • Remove language in SMLT

    Hi, I have to install French Canadian 3F language. I have classify it in SMLT with English as supplement language but not imported the supplementation language to individual clients. SAP is not allowing any changes to that entry nor i can able to del