How do I escape SQL query's single quotes for query generated in
javascript/jquery?
I am using javascript/jquery to generate a sql query. I have a sql query
I'm generating and using inside a javascript/jquery script.
Something like this:
var storeName;
var query = "SELECT * FROM stores where storeName = '" + storeName + "';";
(storeName is generated through jquery when a user selects from html)
So when storeName is something like "Jackson Deli" the query runs just fine.
But then when storeName is "Jackson's Deli" it does not work and it seems
to be because the apostrophe in Jackson's is treated like a closing quote.
I know I can escape a quote by doubling it if I was hard-coding the
query... so
SELECT * FROM stores where storeName = 'Jackson''s Deli';
should work. But I'm not hard-coding the query. Instead it's being
generated by user input and may or may not have an apostrophe in the name.
How would I go about escaping ' this character in this case? I would need
it to work inside Javascript/jquery.
Would I need to write an if statement that looks for ' in storeName and
replaces it with '' ?? Or is there another way to go about this?
No comments:
Post a Comment