java - Error when retrieving from my xml document using xquery -

i trying retrieve authors xml documents of authors have apostrophe's in names results throw error.

input:

<dblp>     <book mdate="2002-01-03" key="books/aw/cerif97">         <author>stefano ceri</author>         <author>piero fraternali</author>         <title>designing database applications objects , rules: idea methodology</title>         <publisher href="db/publishers/aw.html">addison-wesley</publisher>         <year>1997</year>         <isbn>0-201-40369-2</isbn>     </book> </dblp> 

java/xquery code:

public arraylist<string> getarraylistofauthors(){      string query = "for $x in fn:distinct-values(doc(\"" +xml_file_name+ "\")//author) " +                     "order $x "+                     "return $x";      system.out.println("xquery query:"+query);     arraylist<string> mylist = new arraylist<string>();     try{         xqdatasource ds = new saxonxqdatasource();         xqconnection conn = ds.getconnection();         xqexpression exp = conn.createexpression();          xqsequence seq = exp.executequery(query);         int = 1;          while (seq.next()) {             i++;             //system.out.println(seq.getatomicvalue());                             mylist.add(seq.getatomicvalue());         }         //system.out.println("\n== total number of authors "+i+" ==");          seq.close();      } catch (xqexception err) {     system.out.println("failed expected: " + err.getmessage());     }               return mylist; } 

error message:

xpst0003 xquery syntax error near #...e $y/author = 'kieran o'neill'#:     unmatched quote in expression error on line 1 column 109  

the error message suggests constructing query string concatenation, perhaps processing list of authors obtained query have shown us. (look query containing $y, isn't 1 in sample).

then change instead of constructing query using concatenation this:

query = "//author[@name="' + name + "']"

you construct query contain parameter:

query = "declare variable $name external; //author[@name=$name]"

and execute supplying value of $name run-time parameter. there several benefits apart avoiding problem of names containing apostrophes: avoid security problems of injection attacks, , performance benefit because can compile query once , use repeatedly.