static public String safeSqlQueryStringValue ( String in ) throws Exception { if ( null == in ) { return "NULL" ; } if ( in . indexOf ( ' ' ) >= 0 ) { throw new Exception ( "Null character found in string value" ) ; } // All quotes should be escaped in = in . replace ( "'" , "''" ) ; // Add quotes again return "'" + in + "'" ; }
This method converts a string into a new one that is safe for a SQL query . It deals with strings that are expected to be string values .