java中PreparedStatement解决需转义字符向数据库中插入时的转义问题

简单的执行如下语句去做数据库的插入操作是有问题的！它处理不了单引号，双引号等需要转义的字符的插入问题！

String sql = "insert into emailOriginal(id,date,subject,source,target" +

") value(\""

+ vo.getId() + "\",\""

+ vo.getDate()+"\",\""

+ vo.getSubject()+"\",\""

+ vo.getSource()+"\",\""

+ vo.getTarget()+"\");";

。。。

pstmt = dbc.getConnection().prepareStatement(sql);

。。。

pstmt.execute(sql);

会有如下错误：

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'notional" stuff

经过查找发现是插入“nation”时，双引号没有经过转义！

现在修改成使用PreparedStatement，用？预处理查询条件，会避免上述简单的字符串拼接造成的转义问题。

String sql = "insert into emailOriginal(id,date,subject,source,target" +
") value(?,?,?,?,?);";

PreparedStatement pstmt = null;
try {
pstmt = dbc.getConnection().prepareStatement(sql);
pstmt.setString(1, vo.getId());
pstmt.setString(2, vo.getDate());
pstmt.setString(3, vo.getSubject());
pstmt.setString(4, vo.getSource());
pstmt.setString(5, vo.getTarget());
pstmt.execute();
//pstmt.execute(sql);
pstmt.close();
} catch (Exception e) {
e.printStackTrace();
}

其中的

pstmt.setString(1, vo.getId());

会帮助字符串转义。

可以插入如下的记录了：

+------+------+--------+--------+----------+

| id | date | source | target | subject |

+------+------+--------+--------+----------+

| id | date | source | target | "subject |

| id | date | source | target | 'subject |

+------+------+--------+--------+----------+