Hi Razmaspaz, no, you're not missing anything. Prepared statements are a good way to avoid having to validate your own SQL strings. Using a third partly like the Jakarta Commons library you linked would also work for SQL.

However, that does not change the fact that you do need regular expressions from time to time, and that Java's RE support SUCKS. It also doesn't change the point of this post, that if you're getting funny results from String.replaceAll() it could well be because both the RE and the replacement need to be double-escaped. Counter-intuitive, a pain in the behind and head-wreaking, but necessary to get Java REs to work.

Bart.