How to escape all special characters in jsp??

[dirtyhawk]

String q = ("update institutes set institute_facilities='"+fac+"' where institute_id = '"+id+"' ");

How can escape all special characters & insert values to db???

Can anybody help me on this??


Thank You.

[JosAH]

@dirtyhawk
What characters are 'special' to you?

kind regards,

Jos

[chaarmann]

There is a
java.net.UrlEncoder.encode()
function that you can use if you have problems with storing/retrieving special characters in the database.

Generally speaking, replacing character a by b in string q is done with:
q.replace(a, b).

If you have more complicated replacements, you should use a RE (Regular Expression) to do the job:
q.replaceAll(RE, b)

For Oracle database for example, you need to replace single quotation marks inside a string by two single quotation marks.

[JosAH]

Note that a PreparedStatement handles the necessary escaping of its parameterized arguments. Also note that URL escaping is something completely different.

kind regards,

Jos

[chaarmann]

@JosAH
Yes, I know.
It's just an expert-trick if you have problems with database specific issues like special characters or trimming:
- if your database can only store ascii-characters (or you don't know / have no rights to configure it to UTF-8), but you need to store some language-specific non-ascii-characters.
- if your database trims leading / trailing whitespaces (or appends some to fill for max-length) according to the column field type, but you want to preserve them. (space --> plus-sign)
- if you don't care how the data looks inside the database, but you care that it is 100% the same before encoding and after retrieving and decoding

You could also use xml encoding/decoding, but the issue with whitespace (cr/lf/tab/space, 0x00-0x1F) remains.