Maybe I'm missing something here. First why can't you just use a prepared statement and avoid this whole thing? Second Check out jakarta commons for StringEscapeUtils: http://commons.apache.org/lang/api/org/apache/commons/lang/StringEscapeUtils.html