App crashes when I type ' in SearchView

Question

I am developing an app in which suggestive list is displayed as I start typing in SearchView. Everything is going well but as I type in SearchView the App just crashes.

 public Cursor searchByBrandText(String inputTextBrand) throws SQLException {
            db = this.getReadableDatabase();
            String where = inputTextBrand;
            String extra = "'%" + where + "%'";
            String query = "SELECT Brand_Name" + " from " + "Sample" + " where "
                    + "Brand_Name" + " LIKE " + extra;

            Cursor mCursor = db.rawQuery(query, null);

            if (mCursor.getCount() <= 0) {
                mCursor.close();
                return null;
            } else {
                return mCursor;
            }
        }

Possible duplicate of [Android quotes within an sql query string](http://stackoverflow.com/questions/1296180/android-quotes-within-an-sql-query-string) — Fred, Nov 13 '15 at 11:18
i am trying to replace null from rawQuery by new string[]{ } but crashing is not resolved on typing ' — Anil Kumar Jha, Nov 13 '15 at 11:21

score 1 · Accepted Answer · answered Nov 13 '15 at 11:20

' is the SQL string delimiter.
You have to double it, if you need to insert a value containing that character.
Like so:

String where = inputTextBrand.replace("'", "''");

Or, better, use bound parameters (in this case there's no need to double the ').
Like so:

String query = "SELECT Brand_Name FROM Sample WHERE Brand_Name LIKE ?";
Cursor mCursor = db.rawQuery(query, new String[]{"%" + inputTextBrand + "%"});

score 0 · Answer 2 · edited May 23 '17 at 11:44

0

The single quotation mark is messing up your sql query, this is reasonably serious because as it is somebody could use your text box to carry out an SQL Injection Attack on your database.

The method of dealing with this has been answered here: Android Quotes within an SQL query string

edited May 23 '17 at 11:44

Community

1
1

answered Nov 13 '15 at 11:16

hughs

91
3

App crashes when I type ' in SearchView

2 Answers2