How to set Escape character in Oracle ?

Question

I am writing accessing Oracle Database via JSP/JS. I would like to know whether it is possible to set ESCAPE character with those SELECT / INSERT INTO / ... commands ?

I know that "SET ESCAPE \" works under SQL Plus.

But is it possible to set it through coding, so that I can make sure that the correct ESCAPE character is in us.

Thanks.

Answer 1

This approach is open to SQL injection attacks.

It would be better to use prepared statements, along with parameterized queries - this way your code isn't open to exploitation, and you don't have to concern yourself with escaping characters. And Oracle has Packages, so you can logically group functions, procedures and define constants in Packages... God, I miss packages...