Writing EnhancedUserType for saving String alike information in Hibernate, avoiding SQL-Injection

Question

I have some entity like an Address. Because of performance issues I want to save the whole entity in a single field, like "street;zip;city".

One can create a EnhancedUserType to do that. In some examples I found and in sources of hibernate the method "objectToSQLString" is always implemented like that:

@Override
public String objectToSQLString(Object object) {
    if (object != null) {
        Address oo = (Address)object;
        return "'" + oo.toSomeString() + "'";
    } else {
        return "";
    }       
}

I do not understand, if the method returns an SQL representation or not. Why are the special symbols, like ['] are not escaped inside the string? How should I escape them? A standard SQL way is of escaping is ['] -> [''], but in some dialects [backslash] must be escaped as well.

Is there some Hibernate utility, which can do escaping for me dependent on dialect? How does Hibernate itself solve this problem? I could not find it in source code :-(

Answer 1

You must indeed return a SQL literal string, surrouned with single quotes, and with internal scopes escaped. AFAIK, only the single quotes must be escaped, by doubling them : 'O''Reilly'. At least that's what apache commons-lang StringEscapeUtils does (or did).

But I doubt you will gain anything by putting a whole address like this in a single column. And you'll lose the possibility to query on individual fields of the address. Have you measured that these three fields caused a performance problem, and that putting them in a single column would solve the problem?