Accept characters like '

[RicardoPereira]

i have a bean with a method that accept the client parameter. The problem is when i search a client with that character ' in the middle, like o'conner. How can i use this characters?

code:
public ArrayList getClients(String Client) throws SQLException {
ArrayList res=new ArrayList();
Connection con = getConnection();
PreparedStatement pstmt=
con.prepareStatement("exec Clients '" + Client + "'");

ResultSet rslt=pstmt.executeQuery();
while (rslt.next()) {
res.add(new TblClients (rslt.getString(1),rslt.getString(2),rslt.getString(3)) );
}
rslt.close();
pstmt.close();
con.close();
return res;
}

 

[sedj]

Here is an example of how to do this :

PreparedStatement pstmt = con.prepareStatement("select * from bla where client = '?'");
pstmt.setString(1, Client);
ResultSet rslt = pstmt.executeQuery();

--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[RicardoPereira]

But i'am using stored procedures

 

[sedj]

In that case why are you using PreparedStatement ? You should be using CallableStatement.

--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[fuadhamidov]

use double '

for each string that you use in query search for ' and put one more ' .
for example

String query = "select ... from palyers where col_name = 'o[b]''[/b]conner'"

 

[sedj]

fuadhamidov :

This really is not a good way of doing it because it is prone to SQL injection attacks.

Depending on how JDBC compliant your driver is, the syntax should be :

CallableStatement cstmt = con.prepareCall("{ Clients(?) }");
cstmt.setString(1, Client);
ResultSet rslt = cstmt.executeQuery();
[code]


--------------------------------------------------
Free Database Connection Pooling Software
[URL unfurl="true"]http://www.primrose.org.uk[/URL]

 

[RicardoPereira]

What is the main difference between CallableStatement and PreparedStatement ?

 

[RicardoPereira]

sedj:

With your i got the error
Microsoft][SQLServer 2000 Driver for JDBC]Invalid parameter binding(s).

 

[sedj]

CallableStatement extends PreparedStatement, and is the JDBC sanctioned/recommended class for executing stored procedures :

http://java.sun.com/j2se/1.4.2/docs/api/java/sql/CallableStatement.html

--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[RicardoPereira]

I still can't pass parameters with ' to my database.

 

[sedj]

Have you tried :

CallableStatement cstmt = con.prepareCall("{ call Clients[?]}");

or 

CallableStatement cstmt = con.prepareCall("{ exec Clients[?]}");

or 

CallableStatement cstmt = con.prepareCall("{ call Clients(?)}");

or 

CallableStatement cstmt = con.prepareCall("{ exec Clients(?)}");

Did you read the docs on it (the link I posted earlier) ? What about your SQLServer documentation on the driver ?

--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[RicardoPereira]

yes but i got everytime the same error:
Microsoft][SQLServer 2000 Driver for JDBC]Invalid parameter binding(s).