15

I am trying to read terms from a database (>10K) and I'm using that term in another query. I'm getting the following error in Oracle:

quoted string not properly terminated'

I did

term.replaceAll("'", "\\'");

but that doesn't seem to do the job from me. Besides, these terms are tokens from documents when they are converted to text. Is there a regular expression that can overcome this problem?

The exact SQL query is:

String sql = "Select * from indexDB where (DocID=" + d.getDocId() + "and Term='" + term + "')";

I'm using Java. The replacement doesn't work for me.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Aashima
  • 163
  • 1
  • 1
  • 7
  • 1
    You need to read up on [SQL Injection](http://en.wikipedia.org/wiki/SQL_injection) – Oded Jul 27 '12 at 18:48
  • 3
    See also http://bobby-tables.com/ for details on how to use parameterized queries in whatever language you're using. This will protect you from SQL injection that Oded referred to. – Andy Lester Jul 27 '12 at 18:51
  • 1
    Yeah went through it and parameterized query did it !! Thanks so much ! – Aashima Jul 27 '12 at 20:18

1 Answers1

38

You can escape a single quote by repeating it:

term.replaceAll("'","''");

An even better option would be a parameterized query. For an example, we'd have to know your client language.

Andomar
  • 232,371
  • 49
  • 380
  • 404