Sql problem

Contributed Library Questions

il.nicker

in Contributed Library Questions • 1 year ago

Hi,

would like to ask if anyone knows a way to insert special characters in mysql?

below is the code,

msql.execute("INSERT INTO testing (message) VALUES ('"+msg+"');" );

There will be error occur when i insert a message that contains character like ', ", and ; i know these got to do with sql injection but i don't want to remove those special character, and would like to insert the message to the database the way it is.

hope you guys can help. Thx.

Replies(2)

PhiLho

Re: Sql problem

1 year ago

Quick Google search:
http://stackoverflow.com/questions/1812891/java-escape-string-to-prevent-sql-injection
Ignoring the prepared statement answers (not usable with SQLibrary), the answer by Alan Moore seems the more suited to your case:

String escMsg= msg.replaceAll("['\"\\\\]", "\\\\$0");
msql.execute("INSERT INTO testing (message) VALUES ('" + escMsg + "');");

If your string can have newlines, they have to be processed as well.
Not super-secure, but at least might avoid base SQL errors.

il.nicker

Re: Sql problem

1 year ago

Thx, really appreciate your help

Top Reply

Statistics

2 Replies
285 Views
0 Followers

Actions

Permalink

Sql problem

Replies(2)

Re: Sql problem

Re: Sql problem

Statistics

Tags

Actions

Related Posts