sql语句中，传入的参数带单引号的问题

1 if(cateName.indexOf("'")!=-1){
2     oql = " select * where name = '"+cateName.replace("'", "''")+"' ";
3 }else{
4     oql = " select * where name = '"+cateName+"' ";
5 }