Java JDBC Prepared Statement 未插入单引号（SQL 转义）

Question

我有以下方法将一个人存入数据库，后来用来创建一个人对象：

public static void addPerson(String personCode, String firstName, String lastName, 
        String phoneNo, String street, String city, String state, 
        String zip, String country) {
    Connection conn = database.com.airamerica.interfaces.DatabaseConnect.getConnection();
    PreparedStatement ps;
    ResultSet rs;
    String addAddressQuery = "INSERT INTO `Addresses` (`street`,`city`,`state`,`zip`,`country`) VALUES (?,?,?,?,?)";
    String checkAddress = "SELECT `address_ID` FROM `Addresses` WHERE street = ? AND city = ? AND state = ? AND zip = ? AND country = ?";
    String addPersonQuery = "INSERT INTO `Persons` (`personCode`,`firstName`,`lastName`,`address_ID`,`phoneNumber`) VALUES (?,?,?,(SELECT `address_ID` FROM `Addresses` WHERE street = ? AND city = ? AND state = ? AND zip = ? AND country = ?),?)";
    try
    {
        ps = conn.prepareStatement(checkAddress);
        ps.setString(1, street);
        ps.setString(2, city);
        ps.setString(3, state);
        ps.setString(4, zip);
        ps.setString(5, country);
        rs = ps.executeQuery();
        if(!(rs.next())){
            ps = conn.prepareStatement(addAddressQuery);
            ps.setString(1, street);
            ps.setString(2, city);
            ps.setString(3, state);
            ps.setString(4, zip);
            ps.setString(5, country);
            ps.executeUpdate();
            ps.close();
        }
        ps.close();
        rs.close();
        ps = conn.prepareStatement(addPersonQuery);
        ps.setString(1, personCode);
        ps.setString(2, firstName);
        ps.setString(3, lastName);
        ps.setString(4, street);
        ps.setString(5, city);
        ps.setString(6, state);
        ps.setString(7, zip);
        ps.setString(8, country);
        ps.setString(9, phoneNo);
        ps.executeUpdate();
        ps.close();
        conn.close();
    }
    catch (SQLException e)
    {
        System.out.println("SQLException: ");
        e.printStackTrace();
        throw new RuntimeException(e);
    }
}

问题是当我们插入像Miles O'Brien 这样的名称时，它会以Miles O'Brien 的形式插入，我尝试使用一种方法将单引号（撇号）替换为其中两个（''）以进行转义。该方法只是导致数据以Miles O''Brien 的形式插入。我们如何解决这个问题？问题在于ps.setString(3, lastName); 我们如何在不以' 形式输入的情况下将姓氏输入数据库？

以防万一您需要它，引擎是 InnoDB，我们使用默认的 UTF8 作为排序规则。

如您所见，姓氏也被传递给方法。

Answer 1

GIGO

一个单步调试器和一个放置良好的断点或以下内容会告诉你这与 JDBC 完全无关。

步进调试器是检查运行代码的首选方式！

public static void addPerson(final String personCode, final String firstName, final String lastName, 
                             final String phoneNo, final String street, final String city, final String state, 
                             final String zip, final String country) {

        System.out.println(String.format("Last Name = %s",lastName));

        // the rest of your code
}