appengine數據存儲查詢轉義單引號（'）

Question

我已經使用了像這裏的javax.jdo.Query JDO for Google App Engine: escaping quotes。然而，我的單引號（'）查詢字符串不斷爆炸。

Query query = pm.newQuery("select from " + Book.class.getName() + " where mArtist== '"+ artist + "' && mTitle=='" + title + "'"); 

這裏是例外

javax.jdo.JDOUserException: Portion of expression could not be parsed: 't Give Up' 
org.datanucleus.store.query.QueryCompilerSyntaxException: Portion of expression could not be parsed: 't Give Up' 

下面是這個query.toString（）

SELECT FROM com.example.Book WHERE mArtist== 'Famous Writer' && mTitle=='We Won''t Give Up' 

葉，我甚至躲過了單引號（'），每雙單引號appengine文檔

a str literal, as a single-quoted string. Single-quote characters in the string must be escaped as ''. For example: 'Joe''s Diner'

Answer 1

通過字符串連接構建查詢幾乎總是一件有風險的事情，即使SQL注入攻擊是不可能的。 （它們不是GAE）

請參閱http://code.google.com/appengine/docs/java/datastore/jdo/queries.html#Introducing_Queries並注意「參數替換」位。

Answer 2

文檔中的示例代碼僅涵蓋單個參數替換。這裏有更多。

Query query = pm.newQuery(Book.class); 
query.setFilter("mArtist == artist && mTitle == title"); 
query.declareParameters("String artist,String title");    
List<Book> list = (List<Book>) query.execute("Famous Writer","We Won't Give Up"); 

一些所謂的問題值得一讀：

How to dynamically build JDO Queries on multiple parameters

Google Datastore problem with query on *User* type