StringEscapeUtils.escapeSql

•  Escapes the characters in a String to be suitable to pass to an SQL query.

For example,

statement.executeQuery("SELECT * FROM MOVIES WHERE TITLE='" + 

StringEscapeUtils.escapeSql("McHale's Navy") + "'");

• At present, this method only turns single-quotes into doubled single-quotes ("McHale's Navy" => "McHale''s Navy"). It does not handle the cases of percent (%) or underscore (_) for use in LIKE clauses.

1.  package com.utilitySample;
2.  import org.apache.commons.lang.StringUtils;
3. 
   
4.  public class StringUtility {
5.  public static void main(String[] args) {
6.    String unescapedSql = "L'OREAL";
7.    System.out.println("After escapeSql::"+StringEscapeUtils.escapeSql(unescapedSql));
8.    System.out.println(unescapedSql);
9. }
10.  }

Output :

 After escapeSql::L''OREAL
 L'OREAL