src/com/vaadin/data/util/SQLUtil.java


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

package com.vaadin.data.util;

public class SQLUtil {
	/**
     * Escapes different special characters in strings that are passed to SQL.
     * Replaces the following:
     * 
     * <list> <li>' is replaced with ''</li> <li>\x00 is removed</li> <li>\ is
     * replaced with \\</li> <li>" is replaced with \"</li> <li>
     * \x1a is removed</li> </list>
     * 
     * Also note! The escaping done here may or may not be enough to prevent any
     * and all SQL injections so it is recommended to check user input before
     * giving it to the SQLContainer/TableQuery.
     * 
     * @param constant
     * @return \\\'\'
     */
    public static String escapeSQL(String constant) {
        if (constant == null) {
            return null;
        }
        String fixedConstant = constant;
        fixedConstant = fixedConstant.replaceAll("\\\\x00", "");
        fixedConstant = fixedConstant.replaceAll("\\\\x1a", "");
        fixedConstant = fixedConstant.replaceAll("'", "''");
        fixedConstant = fixedConstant.replaceAll("\\\\", "\\\\\\\\");
        fixedConstant = fixedConstant.replaceAll("\\\"", "\\\\\"");
        return fixedConstant;
    }
}