security - 适用于 Google App Engine 的 JDO：转义引号

Question

如何在 JDO（Google App Engine）中转义查询参数？

例如，如果变量名可能包含不安全字符作为单引号 (')，我如何使下一个片段安全

PersistenceManager pm = ...;
String query = "select from Person where name='"+name+"'";
List<Shortened> shortened = (List<Shortened>) pm.newQuery(query).execute();

Answer 1

改用查询参数，它比在查询本身中包含值要安全得多。以下是 GAE 文档中的示例：

Query query = pm.newQuery("select from Employee " +
                          "where lastName == lastNameParam " +
                          "order by hireDate desc " +
                          "parameters String lastNameParam");

List<Employee> results = (List<Employee>) query.execute("Smith");