MySQLSyntaxErrorException尝试插入包含'

Question

的值时我知道MySQLSyntaxErrorException错误中已经有无数条目了，但是我还没有阅读任何已解决我的问题的帖子，而且我真的可以使用额外的一组眼睛尝试指出我出错的地方。

我正在创建一个简单的网络抓取工具，它将维基百科页面上列出的啤酒厂名称存储在使用WAMP本地存储的基本MySQL表格中。我现有的代码似乎正常工作，直到我遇到名称中包含''的啤酒厂名称。这也是我第一次使用JSoup进行HTML解析。

这里是我当前的代码：

import java.io.IOException; 
import java.sql.PreparedStatement; 
import java.sql.ResultSet; 
import java.sql.SQLException; 
import java.sql.Statement; 

import org.jsoup.Jsoup; 
import org.jsoup.nodes.Document; 
import org.jsoup.nodes.Element; 
import org.jsoup.select.Elements; 

public class Main { 
public static DB db = new DB(); 

public static void main(String[] args) throws SQLException, IOException { 
    db.runSql2("TRUNCATE Brewery;"); 
    processPage("myBrew"); 
    System.out.println("done parsing"); 
} 


// recursive method to find brewery names by adding db entry for all <li><a> 
// values on site. Might not need recursion for this. 
public static void processPage(String bName) throws SQLException, 
     IOException { 
    // check if the given URL is already in database 
    String sql = "select * from Brewery where name = '" + bName + "'"; 
    ResultSet rs = db.runSql(sql); 
    if (rs.next()) { 
     // do nothing because already exists 
    } else { 
     // store the brewery to database to avoid parsing again 
     sql = "INSERT INTO `Crawler`.`Brewery` " + "(`name`) VALUES " 
       + "(?);"; 
     PreparedStatement stmt = db.conn.prepareStatement(sql, Statement.RETURN_GENERATED_KEYS); 
     stmt.setString(1, bName); 
     //stmt.execute(); 
     stmt.executeUpdate(); 

     // get useful information 
     //research this further to better understand what it's doing 
     Document doc = Jsoup.connect("https://en.wikipedia.org/wiki/List_of_microbreweries").get(); 

     //case-senstive 
     if (doc.text().contains("Brewery")) { 
      System.out.println(bName); 
     } 

     // get all links and recursively call the processPage method 
     Elements breweries = doc.select("a[href]"); 
     for (Element link : breweries) { 
      //System.out.println("element class: " + link.nodeName()); 
      //System.out.println("parent class: " + link.parent().nodeName()); 
      System.out.println("element title: " + link.attr("title")); 

      //assumes that all brewery names will be listed in <li><a> html format 
      if (link.nodeName() == "a" && link.parent().nodeName() == "li") { 
       System.out.println("recursive call tripped"); 
       String tmp = link.attr("title"); 
       //String first = tmp.charAt(0) + ""; 
       if(tmp.contains("'")){ 
        String brew = tmp.replaceAll("'", "\\\'"); 
        /*System.out.println("new string: '" + brew +"'"); 
        processPage("'" + brew + "'");*/ 
        System.out.println("new string: " + brew); 
        processPage(brew); 
       } 
       else { 
        if (tmp.contains(" (page does not exist)")) { 
         String brew = tmp.replaceAll(" (page does not exist)", ""); 
         System.out.println("shortened string: " + brew); 
         processPage(brew); 
        } 
        else { 
         //no ' exists in the name 
         processPage(tmp); 
        } 
       } 

      } 
     } 
    } 
} 
} 

当使用这种语法，我得到以下错误：

Exception in thread "main" com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's All Natural Brewing Company'' at line 1 
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) 
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source) 
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source) 
at java.lang.reflect.Constructor.newInstance(Unknown Source) 
at com.mysql.jdbc.Util.handleNewInstance(Util.java:404) 
at com.mysql.jdbc.Util.getInstance(Util.java:387) 
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:939) 
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3878) 
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3814) 
at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:2478) 
at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2625) 
at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2547) 
at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2505) 
at com.mysql.jdbc.StatementImpl.executeQuery(StatementImpl.java:1370) 
at DB.runSql(DB.java:26) 
at Main.processPage(Main.java:57) 
at Main.processPage(Main.java:95) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:101) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:101) 
at Main.processPage(Main.java:101) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:101) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:101) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.main(Main.java:17) 

有了这个代码，包含啤酒厂的名字“是没有得到存储在我的MySQL表。但是，如果我替换下面的行

String brew = tmp.replaceAll("'", "\\\'"); 

与

String brew = tmp.replaceAll("'", "\\\\'"); 

然后啤酒厂的名字被打存储到我的MySQL表，我得到以下错误的下一个啤酒厂的名字被刮掉前：

Exception in thread "main" com.mysql.jdbc.exceptions.jdbc4.MySQLIntegrityConstraintViolationException: Duplicate entry 'Beau\'s All Natural Brewing Company' for key 'brewery_name' 
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) 
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source) 
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source) 
at java.lang.reflect.Constructor.newInstance(Unknown Source) 
at com.mysql.jdbc.Util.handleNewInstance(Util.java:404) 
at com.mysql.jdbc.Util.getInstance(Util.java:387) 
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:932) 
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3878) 
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3814) 
at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:2478) 
at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2625) 
at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2551) 
at com.mysql.jdbc.PreparedStatement.executeInternal(PreparedStatement.java:1861) 
at com.mysql.jdbc.PreparedStatement.executeUpdateInternal(PreparedStatement.java:2073) 
at com.mysql.jdbc.PreparedStatement.executeUpdateInternal(PreparedStatement.java:2009) 
at com.mysql.jdbc.PreparedStatement.executeLargeUpdate(PreparedStatement.java:5094) 
at com.mysql.jdbc.PreparedStatement.executeUpdate(PreparedStatement.java:1994) 
at Main.processPage(Main.java:67) 
at Main.processPage(Main.java:95) 
at Main.processPage(Main.java:95) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:101) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:101) 
at Main.processPage(Main.java:101) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:101) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:101) 
at Main.processPage(Main.java:105) 
at Main.processPage(Main.java:105) 
at Main.main(Main.java:17) 

使用

String brew = tmp.replaceAll("'", "''"); 

而不是

String brew = tmp.replaceAll("'", "\\\\'"); 

导致同样的问题。从我的DB类

我runSql方法：

public ResultSet runSql(String sql) throws SQLException { 
    Statement sta = conn.createStatement(); 
    return sta.executeQuery(sql); 
} 

如果任何人有任何想法，请让我知道。我花了几个小时尝试不同的转义字符等，但我找不到解决这个问题的任何东西。另一双眼睛看着我的代码可能只是我需要的东西。在此先感谢您的帮助。

编辑： 我目前不使用Spring或Hibernate。

Answer 1

如果你已经知道如何使用值标记（?）一PreparedStatement为INSERT声明，为什么不使用一个用于SELECT说法吗？

即将以正确的方式解决您的错误。

Answer 2

对这两个查询使用PreparedStatement，您不必担心替换引号，并且您的选择将与插入行为一致。现在看来，select与刚刚插入的brewery不匹配，但插入由于重名而失败。