JDO for Google App Engine: escaping quotes

google-app-engine, jdo, jdoql, security

Solution

Use query parameters instead, it's a much safer than including the values in the query itself. Here is an example from the GAE documentation:

Query query = pm.newQuery("select from Employee " +
                          "where lastName == lastNameParam " +
                          "order by hireDate desc " +
                          "parameters String lastNameParam");

List<Employee> results = (List<Employee>) query.execute("Smith");

Problem

How do I escape parameters of queries in JDO (Google App Engine)? For example, how do I make the next snippet safe, if the variable name may contain unsafe chars as single quotes (') ``` PersistenceManager pm = ...; String query = "select from Person where name='"+name+"'"; List<Shortened> shortened = (List<Shortened>) pm.newQuery(query).execute(); ```

Original source