java - Migrating StringEscapeUtils.escapeSql from commons.lang -
i have started migrate commons.lang 2 commons.lang3.
according https://commons.apache.org/proper/commons-lang/article3_0.html
stringescapeutils.escapesql
this misleading method, handling simplest of possible sql cases. >as sql not lang's focus, didn't make sense maintain method.
understand recommended use instead of it?
clarification
can recommend third party perform simple escapesql similar stringescapeutils.escapesql?
at present, method turns single-quotes doubled single-quotes ("mchale's navy" => "mchale''s navy").
this method code:
/** 675 * <p>escapes characters in <code>string</code> suitable pass 676 * sql query.</p> 677 * 678 * <p>for example, 679 * <pre>statement.executequery("select * movies title='" + 680 * stringescapeutils.escapesql("mchale's navy") + 681 * "'");</pre> 682 * </p> 683 * 684 * <p>at present, method turns single-quotes doubled single-quotes 685 * (<code>"mchale's navy"</code> => <code>"mchale''s navy"</code>). not 686 * handle cases of percent (%) or underscore (_) use in clauses.</p> 687 * 688 * see http://www.jguru.com/faq/view.jsp?eid=8881 689 * @param str string escape, may null 690 * @return new string, escaped sql, <code>null</code> if null string input 691 */ 692 public static string escapesql(string str) { 693 if (str == null) { 694 return null; 695 } 696 return stringutils.replace(str, "'", "''"); 697 }
so replace method simple call string#replace
.
however, there reason method removed. half-baked , cannot think of reason why want use it. run jdbc queries example, can , should use bind variables instead of trying interpolate , escape string literals.
Comments
Post a Comment