Android Quotes Within an SQL Query String

Android Single Quote In SQL With a LIKE StateMent

To fix it you need to replace the single quote with two single quotes. Try using something like...

SomeSongTitle = SomeSongTitle.replace("'", "''");

Single quote in SQL

In SQL, single quotes must be escaped by doubling them.
There would be a helper function to do this, but it is easier to just use parameters:

public void addResult(String name, String date, String content) {
    database.execSQL("INSERT INTO " + tbName +
                     " (" + keyDate + ", " + keyName + ", " + keyContent + ")" +
                     " VALUES (?, ?, ?);",
                     new Object[]{ date, name, content });
}

Even easier is to use insert(), which creates the SQL command for you:

public void addResult(String name, String date, String content) {
    ContentValues cv = new ContentValues();
    cv.put(keyDate, date);
    cv.put(keyName, name);
    cv.put(keyContent, content);
    database.insertOrThrow(tbName, null, cv);
}

insert string using sqlite in android containing single and double quotes in it

Without any hardcoding or anything you can directly insert with using ContentValues like below..

ContentValues values = new ContentValues();
long retvalue = 0;
values.put("_id", id_here);
values.put("text", your_text_here);
retvalue = MyClass.db.insertWithOnConflict(table, null, values, CONFLICT_REPLACE);

Escape single quote character for use in an SQLite query

Try doubling up the single quotes (many databases expect it that way), so it would be :

INSERT INTO table_name (field1, field2) VALUES (123, 'Hello there''s');

Relevant quote from the documentation:

A string constant is formed by enclosing the string in single quotes ('). A single quote within the string can be encoded by putting two single quotes in a row - as in Pascal. C-style escapes using the backslash character are not supported because they are not standard SQL. BLOB literals are string literals containing hexadecimal data and preceded by a single "x" or "X" character. ... A literal value can also be the token "NULL".

handeling querying an item with a single quote in it

From http://orafaq.com/faq/:

Use two quotes for every one displayed. Examples:

SELECT 'Frank''s Oracle site' AS text FROM DUAL;

TEXT:
Franks's Oracle site

Also: Android quotes within an sql query string

How to escape single quotes for SQL insert...when string to insert is in a user generated variable

You can do either of the below:

1. Use the PreparedStatement class. (Recommended)

   String userString="a'bcd";
   String myStatement = " INSERT INTO MYTABLE (INSERTCOLUMN) VALUES (?)";
   PreparedStatement statement= con.prepareStatement   (myStatement );
   statement.setString(1,userString);
   statement.executeUpdate();
   

2. Escape the single quotes.

   In SQL, single quotes will be escaped by using double single quotes. ' --> ''

   String userString="a'bcd";
   String changedUserString = userString.replace("'","''");
           //changedUserString  = a''bcd
   String insertTableSQL = "INSERT INTO myTable (insertColumn) VALUES("
                           +" '"+changedUserString +"' )";
   

---

Related Topics