update postgresql with syntax errors - sql

Question

I have one table called test, which has 4 columns:
id INT
v_out INT
v_in INT
label CHARACTER
I'm trying to update the table with the following query:
String sql = "
update
test
set
v_out = temp.outV
, v_in = temp.inV
, label = temp.label
from (
values
(1,234,235,'[abc]') // these value are read from other places
,(2,234,5585,'[def]') //[abc] = object.toString();
) as temp (e_id, outV, inV, label)
where
id = temp.e_id;
When I execute it, I got the error:
org.postgresql.util.PSQLException: ERROR: syntax error at or near "["
before get this error, i already update over 3000 rows.
so whats the reason caused this? is it because "[" this character?
this is the original table:
create table edges(
id serial not null primary key,
vertex_out int,
vertex_in int,
label character varying(255),
constraint fk_vertex_out foreign key (vertex_out) references vertices(id) on delete cascade,
constraint fk_vertex_in foreign key (vertex_in) references vertices(id) on delete cascade
);

Answer 1

The most likely problem here is string interpolation in SQL query (it is a very bad practice).
Look at this example:
values
(1,234,235,'[abc]''),
(2,234,5585,'[def]')
The ' symbol in the name of the first object breaches the string boundaries causing ERROR: syntax error at or near "[": on the second line.
You can search for SQL Injection in the internet to get details about this problem.