Manually construct SQL with binary data in Java.

Question

I have a small program that manually creates queries. In pseudo code, it's basically done like this

string[] a = new string[x];
a[0] = "data 1";
a[1] = "data 2";
a[2] = "data 3";
string query = "insert into x (y) values(";
for i {
query += a[i] + ",";
}
query += ");";

I'm aware that this usage is sub-optimal and I should do a complete re-write at some point. Now I need to add some binary data to the a-array. Given a byte[] b, how can I add it to the query? I haven't tried, but I'm assuming that b.toString() or just query+=b is gonna corrupt my data?

Answer 1

Don't put it in the SQL to start with. Use a parameterized query: it'll be a lot easier, and won't risk SQL injection attacks.