java - appengine 数据存储区查询转义单引号 (')

Question

我在这里使用了 javax.jdo.Query JDO for Google App Engine: escaping quotes 。然而，我的带有单引号(')的查询字符串不断被分解。

Query query = pm.newQuery("select from " + Book.class.getName() + " where mArtist== '"+ artist + "' &&  mTitle=='" + title + "'");

这是一个异常(exception)

javax.jdo.JDOUserException: Portion of expression could not be parsed: 't Give Up' 
org.datanucleus.store.query.QueryCompilerSyntaxException: Portion of expression could not be parsed: 't Give Up'

这是这个query.toString()

SELECT FROM com.example.Book WHERE mArtist== 'Famous Writer' &&  mTitle=='We Won''t Give Up'

是的，我什至在每个 appengine 文档中使用双单引号转义了单引号(')

a str literal, as a single-quoted string. Single-quote characters in the string must be escaped as ''. For example: 'Joe''s Diner'

Answer 1

通过字符串连接构建查询几乎总是一件有风险的事情，即使 SQL 注入(inject)攻击是不可能的。 (他们不属于 GAE。)

参见http://code.google.com/appengine/docs/java/datastore/jdo/queries.html#Introducing_Queries并注意“参数替换”部分。