title: How to escape single quotes for SQL insert...when string to insert is in a user generated variable
body: <p>I am building an insert command to execute using jdbc. Part of it is to concatenate a user generated string...this all works until the user uses a string like this:</p>
  
  <p>a'bcd</p>
  
  <pre><code>String userString="a'bcd";
  String insertTableSQL = "INSERT INTO myTable "
                              + "(insertColumn) " 
                              + "VALUES("
                                  +"'"+userString+"'"
                                  +")";
  
  statement.executeUpdate(insertTableSQL);
  </code></pre>