#63 dynamic sql escape special character bug

[Jin Tong]

In find_XXXXX methods, the SQLs are built dynamically
by appending to an existing buffer with new arguments.
SQL control characters are not properly escaped. For
example, if one string argument contains "'", the
resulting sql that is sent to the database will be
ill-formed and a resulting SQLException will usually be
thrown. This happens at least with MySQL and Oracle
database (and their default JDBC driver).

[Steve Viens]

Logged In: YES
user_id=73959

Replaced use of JDBC Statement with PreparedStatement so
that all SQL values are escaped by the JDBC driver.

Steve

[Jin Tong]

Logged In: YES
user_id=830643

Replacing with prepared statement this way doesn't solve the
problem. The SQL parameters are still dynamically appended,
all the control characters are still literally appended to
the SQL. PreparedStatement handles the control characters
when the parameters are set by setXXXX method on the
PreparedStatement. As such, the CVS code (as of 08/12/2003)
still doesn't handle control characters (such as "'") correctly.