如何向sql数据库添加包含双引号的字符串?-Howtoaddastringcontaingadoublequotetoasqldatabase?

2  

You need to escape the string value to make a string literal in the query.

您需要转义字符串值，以便在查询中创建字符串文字。

When you are using quotation marks to delimiter the string:

当您使用引号分隔字符串时:

• A backslash (\) in the string should be replaced by two backslashes.

  字符串中的反斜杠(\)应该被两个反斜杠替换。

• A quotation mark (") in the string should be replaced by a backslash and a quotation mark.

  字符串中的引号(")应该用反斜杠和引号替换。

If you would use apostrophes (') to delimiter the string (which is more common in SQL), you would escape the apostrophes instead of the quotation marks.

如果您使用撇号(')来分隔字符串(在SQL中更常见)，您将转义撇号，而不是引号。

If possible, you should use parameterised queries, instead of concatenating the values into the queries.

如果可能，您应该使用参数化查询，而不是将值连接到查询中。

1  

You're experiencing benign SQL injection. Be lucky string was not Little Bobby Tables.

您正在经历良性SQL注入。幸运之弦不是小波比表。

Instead you should use parameterized queries like INSERT INTO tableName VALUES (?) and send the value of string via a parameter.

相反，您应该使用参数化查询，如插入到tableName值(?)中，并通过参数发送字符串值。

For more details, see the JDBC documentation at http://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html

有关详细信息，请参阅http://docs.oracle.com/javase/tutorial/jdbc/basics/preparedhtml的JDBC文档

Now, to answer the question: Assuming the string does not come from a user source and instead you are trying to write the query yourself, you can replace " with \" in the string before concatenating.

现在，要回答这个问题:假设字符串不是来自用户源，而是您自己尝试编写查询，那么您可以在连接之前在字符串中替换“\”。

0  

Per MySQL Spec it recignizes \" as escaping double quote. you can as well use two double quote "" to escape double quote " character

根据MySQL规范，它接收到“作为转义双引号”。您也可以使用两个双引号“”来转义双引号“字符”

\" A double quote (“"”) character

一个双引号(" " ")字符

0  

change this

改变这一切

String ssql = "INSERT INTO tableName VALUES (\""+ string + "\")";

字符串ssql = "插入到tableName值(\" + String + "\" \")";

to

来

String ssql = "INSERT INTO tableName VALUES ('"+ string + "')";

Or simplify it with a PreparedStatement like this

或者用这样的PreparedStatement化简它

String ssql = "INSERT INTO tableName VALUES (?)";
preparedStatement.setString(1,"string");

When you want to insert double-quotes you need to escape them something like this

当你想插入双引号时，你需要避开它们。

String ssql = "INSERT INTO tableName VALUES (?)";
preparedStatement.setString(1,"\"string\"");

This shall insert "string" in the table

这将在表中插入“字符串”。

0  

I tried adding the string by escaping the double quote but that didn't work. The only way I could add the string is by using PreparedStatement instead of a Statement class.

我试图通过转义双引号来添加字符串，但这行不通。添加字符串的唯一方法是使用PreparedStatement而不是Statement类。

String string = "abc\"abc";
String sql = "INSERT INTO tableName VALUES(?)";

cOnnection= DriverManager.getConnection(DB_URL, USER, PASS);
preparedStatement = connection.prepareStatement(sql);
preparedStatement.setString(1, string);
preparedStatement.executeUpdate();

This code segment successfully adds the string containing the double quote into the database.

这个代码段成功地将包含双引号的字符串添加到数据库中。