How to escape " ' " in sql

Question

Hi I am searching for a name combination in database. I am passing the combination as follows

"firstName='" + firstName + "'", "middleName='" + middleName + "'", "lastName='" + lastName + "'"

This works fine. But the problem comes where there are some " ' " in names how can i rectify it? eg: Johns' or Jerry's etc causes exception

Answer 1

use preparedStatement it is easy for you

ps.executeUpdate("INSERT INTO tb_name values(?,?) WHERE id=?");
ps.setString(1,firstName);
ps.setString(2,middleName);
ps.setInt(3,id);
ps.execute();

Answer 2

At least for MySQL, you have to put another ' before:

INSERT INTO table (column) VALUES ('this isn''t it');