Android quotes in sql query string

Question

I want to execute the following query:

uvalue = EditText( some user value ); p_query = "select * from mytable where name_field = '" + uvalue + "'" ; mDb.rawQuery( p_query, null ); 

if the user enters a single quote in his input, it is reset. If you change it to:

 p_query = "select * from mytable where name_field = \"" + uvalue + "\"" ; 

it crashes if the user enters a double quote in his input. and, of course, they could always enter single and double quotes.

Answer 1

You should use the rawQuery selectionArgs parameter:

 p_query = "select * from mytable where name_field = ?"; mDb.rawQuery(p_query, new String[] { uvalue }); 

This not only solves your problem with quotes, but also softens SQL Injection .

Answer 2

DatabaseUtils.sqlEscapeString is working correctly for me. The string is enclosed in single quotes, and the single quotes within the string become double quotes. Tried to use selectionArgs in getContentResolver (). Query (), but it didn't work at all.

Answer 3

Have you tried replacing one quotation mark with two single quotation marks? This works for entering data into a database.

Answer 4

I prefer to avoid single quotes and double quotes in each insert statement using Sqlite as follows:

  String sqlite_stament = sqlite_stament.replace("'", "''").replace("\"", "\"\""); 

Answer 5

You have to change

 p_query = "select * from mytable where name_field = '" + uvalue + "'" ; 

like

 p_query = "select * from mytable where name_field = '" + android.database.DatabaseUtils.sqlEscapeString(uvalue)+ "'" ; 

Answer 6

I have the same problem, but now it is solved simply by writing code, as in your case you want to insert a uvalue value. Then write how

 uvalue= EditText( some user value ); uvalue = uvalue.replaceAll("'", "''"); p_query = "select * from mytable where name_field = '" + uvalue + "'" ; mDb.rawQuery( p_query, null ); 

cool..!!