Develop Reference

Saving webview geturl and getitle in Sqlite database. Problem with syntax error apostrophe '

When im saving webview.getTitle (); in Sqlite database, if in title has apostrophe ('), then i got error -
android.database.sqlite.SQLiteException: near "at": syntax error (code 1): , while compiling: INSERT INTO Favorite VALUES('4 madhab bid'at tavassul', 'file:///android_asset/web/akaid/4maddhab/4.htm' );
My code like this
mysql objcon = new mysql(this, null, null, 1);
SQLiteDatabase db = objcon.getReadableDatabase();
db.execSQL(
"INSERT INTO Favorite VALUES('"
+ txtnombre.getText()
+ "', '"
+ txtlink2.getText()
+"' );"
);
How to solve this problem?

There is a single quote embedded within txtnombre.getText() : '4 madhab bid'at tavassul'. This causes SQLite to wrongly consider that this quote marks the end of the first value to insert.
To avoid that, you could consider manually doubling the single quotes :
db.execSQL(
"INSERT INTO Favorite VALUES('"
+ txtnombre.getText().replaceAll("'","\''")
+ "', '"
+ txtlink2.getText().replaceAll("'","\''")
+"' );"
);
I would recommend using bind parameters. With this option, your database driver handles escaping behind the hood :
q = "INSERT INTO Favorite VALUES(?, ?)";
t1 = txtnombre.getText();
t2 = txtlink2.getText();
db.rawQuery(q, new String[] { t1, t2 });
Finally, another approach in Android would be to use native method sqlEscapeString(), which is primarily built for this purpose.
Also, as commented by pskink, using insert() would better fit your use case than raw SQL.

Android - DatabaseUtils.sqlEscapeString() does not work

I want to insert "women's cloth" in the database, so I use
String name = DatabaseUtils.sqlEscapeString("women's cloth");
but it gives out put like
"'Women''s Clothing'"
and while inserting app crashes and gives
E/SQLiteLog: (1) near ",": syntax error
--------- beginning of crash -----------------
07-12 12:42:19.628 22387-22521/com.i4ustores E/AndroidRuntime: FATAL EXCEPTION: Thread-8634
android.database.sqlite.SQLiteException: near ",": syntax error (code 1):

From your simple code, I guess you create SQL statement manually.
Try using String.format:
String query = String.format("SELECT * FROM %s WHERE %s = ?",
TABLE_NAME, SEARCH_KEY);
Read more at: Local Databases with SQLiteOpenHelper
Or try using PreparedStatement like below:
PreparedStatement pstmt = con.prepareStatement("UPDATE EMPLOYEES
SET SALARY = ? WHERE ID = ?");
pstmt.setBigDecimal(1, 153833.00)
pstmt.setInt(2, 110592)
Please be aware that the parameterIndex (i.e 1 and 2 in above code) start from 1.

getting error : Caused by: android.database.sqlite.SQLiteException: near "TABLENAME" syntax error (code 1) compiling a SELECT query

I'm getting the following error while compiling a SELECT query:
Caused by: android.database.sqlite.SQLiteException: near "group": syntax error (code 1): , while compiling: SELECT group_id, logo FROM group WHERE group_name = 'Empty Group'
The query is created as:
c = database.query(TABLE_GROUP, new String[]{KEY_GROUPID, KEY_LOGO}, KEY_GROUPNAME + " = '" + description + "'", null, null, null, null);
with:
TABLE_GROUP = "group";
KEY_LOGO = "logo";
KEY_GROUPID = "group_id";
and the creation script for the table:
create table group
(group_id integer primary key autoincrement,
group_name text not null,
logo string);
Anyone knows what's wrong?

group is a SQLITE keyword and, as every reserved words, it can't use it as table/column name. To fix chose another name for your column. You can find a list of the SQLITE reserved keywords here

rawQuery() in Android SQLite not compiling parameters

While trying to implement SQLite storage ran into strange behavior.
The "?"-symbols are not substituted.
My code:
public class DBHandler extends SQLiteOpenHelper {
public void writeTask(JSONObject object) throws JSONException {
SQLiteDatabase db = this.getWritableDatabase();
String id = object.get(OBJECT_ID).toString();
String content = object.toString();
String md5 = "md5"; //testing
Cursor c = db.rawQuery("INSERT OR REPLACE INTO ? ( ? , ? , ? ) VALUES ( ? , ? , ?);", new String[] {TABLE_OBJECTS, OBJECT_ID, OBJECT_CONTENT, OBJECT_MD5, id, content, md5 });
}
}
Then it throws a strange error:
android.database.sqlite.SQLiteException: near "?": syntax error (code 1): , while compiling: INSERT OR REPLACE INTO ? ( ? , ? , ? ) VALUES ( ? , ? , ?);
First mistake corrected, but still not working:
String selectQuery = "INSERT OR REPLACE INTO " + TABLE_OBJECTS + " ("
+ OBJECT_ID + "," + OBJECT_CONTENT + "," + OBJECT_MD5 + ") "
+ "VALUES ( ? , ? , ?);";
String[] args = { id, content, md5 };
Log.d("FP", selectQuery);
Cursor c = db.rawQuery(selectQuery,args);
Now database is untouched after this query. Logs show my query:
INSERT OR REPLACE INTO objects (id,content,md5) VALUES (?,?,?);
Any suggestions?
so, rawQuery() is just for SELECT.
But i still need to do escaping special characters, because content-variable is a stringified JSON and execSQL does not allow this.

You can use ? only for binding literals such as those in your VALUES(), not for identifiers such as table or column names earlier in your SQL.
If you need to use variables for identifiers, use regular string concatenation in Java.
Also note that rawQuery() alone won't execute your SQL. Consider using execSQL() instead.

sqlite.SQLiteException: near "s": syntax error: because of apostrophe

The song name that I want to insert it into my table contains a " ' " (apostrophe )so , there is an error when the request is excuted. How can I fix it
Cursor pid = mDB.rawQuery("select Id FROM MusicPlayer WHERE "Path ='" + sname + "';", null);
I am getting sname runtime so .. sname=/mnt/sdcard/Now Thats What I Call Music 85 [Bubanee]/16 - Let's Get Ready To Rhumble (100% Radio Mix) - PJ & Duncan.mp3
I get below error..
android.database.sqlite.SQLiteException: near "s": syntax error: , while compiling: SELECT Id FROM MusicPlayer WHERE Path ='/mnt/sdcard/Now Thats What I Call Music 85 [Bubanee]/16 - Let's Get Ready To Rhumble (100% Radio Mix) - PJ & Duncan.mp3';
Because sname contain let's word with ' which gives me error.

In theory you could escape ' as '' in SQL.
However, it's better to use variable binding. Replace the string literals in SQL with ? and supply corresponding number of Strings in an array:
Cursor pid = mDB.rawQuery("select Id FROM MusicPlayer WHERE Path = ?;",
new String[] { sname });

you can get details for Sting within comma or someother means use like this cursor.
Cursor cursor = odb.rawQuery("SELECT * FROM " + DATABASE_TABLE + " WHERE " + KEY_ITEM + "=?;", new String[]{comboname});
Thanks laalto sir your answer is work perfectly.