Ormlite exception with single quote in text using LIKE query - ormlite

Question

I've got what seems to be a bug. I can add an entry to the database which has a single quote in the text.
However, when I search using QueryBuilder, for any text LIKE xyz, if xyz has a single quote in it, I get MySQL complaining about malformed SQL.
Other than parsing all strings myself, is there some method in Ormlite I can call to "santize" my strings?
Sample code is below:
public boolean isDuplicate () {
QueryBuilder<Company, Long> qb = getDao().queryBuilder() ;
Where<Company, Long> where = qb.where() ;
try {
if (Strings.isValid(name))
where.like("name", name) ;
if (Strings.isValid(regNo)) {
if (Strings.isValid(name))
where.or() ;
where.eq("regNo", regNo) ;
List<Company> res = where.query() ;
if (res != null && res.size() > 0)
return true ;
else
return false ;
}
} catch (SQLException e) {
GlobalConfig.log(e, true);
}
return false ;
}
This creates a SQL error if the company name has a single quote in it:
Creating default entries for Well Don't Delete Me 2 Please Pte Ltd.
[12-07-2013 13:45:42] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 't Delete Me 2 Please Pte Ltd.' OR regNo = 'delete' )' at line 1
Any suggestions welcome.

Answer 1

Ok, I figured this out- I need to use the SelectArg method of querying the database.
So it now looks like this:
...
if (Strings.isValid(name))
{
SelectArg arg = new SelectArg () ; // Added
arg.setValue (name) ; / Added
where.like("name", arg) ; // Changed
}
if (Strings.isValid(regNo))
{
if (Strings.isValid(name))
where.or() ;
SelectArg arg = new SelectArg () ; // Added
arg.setValue (regNo) ; // Added
where.eq("regNo", arg) ; // Changed
List<Company> res = where.query() ;
if (res != null && res.size() > 0)
return true ;
else
return false ;
...
What I've learned is this: you must use one SelectArg PER item.
Now my question to Gray is why not make this a default behaviour? When I insert or update it seems to happen automatically, and to get the problem I found solved I have to add more
lines of code that could easily be part of the internal query handling.
I understand his concerns in this post but I agree with Dale. Maybe a halfway house is to have a flag to say which way Ormlite should treat parameters to the query methods.
I admire the flexibility and simplicity of the "programmable" SQL in Ormlite and in almost every case, Ormlite related code is concise, easy to follow and logical. This is one rare case where I feel it is more verbose than necessary, for no net benefit. Just my opinion.