如何处理 SQL 查询中的保留字符

Question

我想从 table 中读取数据，但出现错误，因为我要比较的值可能包含这样一个词：abcd l'jdmd

我这样试：

String s = "select ref(ad) from adresse_tab ad where ad.ort='"+rs.getString(11)+"' and ad.plz='"+rs.getString(13)+"' and ad.land='"+rs.getString(14)+"'";
        
PreparedStatement stmt5 = nsdCon.prepareStatement(s);
ResultSet rs5 = stmt5.executeQuery();

查询可能如下所示：

select ref(ad) 
  from adresse_tab ad 
 where ad.ort='Frankfurt am Main' 
   and ad.plz='65301' 
   and ad.land='Deutschland' 
   and ad.strasse='almundo l'tare '

所以这个查询中的问题是这个比较：

ad.strasse='almundo l'tare '

如何处理 SQL 查询中的保留字符？

Answer 1

您不应将查询参数直接添加到查询字符串中。使用 Prepared Statement instead and pass the query parameters there. See also Does the preparedStatement avoid SQL injection?

Answer 2

ad.strasse='almundo l'''tare '

Answer 3

准备语句的全部意义在于在查询中使用参数，以便可以自动转义值：

String s = "select ref(ad) from adresse_tab ad where ad.ort=? and ad.plz=? and ad.land=?";
PreparedStatement stmt5 = nsdCon.prepareStatement(s);

stmt5.setString(1, rs.getString(11));
stmt5.setString(2, rs.getString(13));
stmt5.setString(3, rs.getString(14));

ResultSet rs5 = stmt5.executeQuery();

Answer 4

请避免使用字符串连接使用提供的参数创建 SQL 查询。相反，您可以继续使用 PreparedStatement，但对实际参数值使用占位符，并使用语句的 set<X>() 方法设置参数。这是official Oracle docs。

You must supply values in place of the question mark placeholders (if there are any) before you can execute a PreparedStatement object. Do this by calling one of the setter methods defined in the PreparedStatement class. The following statements supply the two question mark placeholders in the PreparedStatement named updateSales:

updateSales.setInt(1, e.getValue().intValue()); updateSales.setString(2, e.getKey()); The first argument for each of these setter methods specifies the question mark placeholder. In this example, setInt specifies the first placeholder and setString specifies the second placeholder.

针对您的情况：

String s = "select ref(ad) from adresse_tab ad where ad.ort=? and ad.plz=? and ad.land=?";

PreparedStatement stmt5 = nsdCon.prepareStatement(s);
stmt5.setString(1, rs.getString(11));
... and so on

Answer 5

使用 prepared statement (and for added clarity of named bind variables you can use an OraclePreparedStatement):

String s = "select ref(ad) from adresse_tab ad where ad.ort=:ort and ad.plz=:plz and ad.land=:land";
PreparedStatement st5 = nsdCon.prepareStatement(s);
OraclePreparedStatement ost5 = (OraclePreparedStatement) st5;
ost5.setStringAtName("ort",rs.getString(11))
ost5.setStringAtName("plz",rs.getString(13))
ost5.setStringAtName("land",rs.getString(14))
ResultSet rs5 = st5.executeQuery();

如何处理 SQL 查询中的保留字符

How can handle reserved character in SQL query

java

sql

oracle

object-oriented-database