fix(sql): escape single quotes in COMMENT text

chat2db-community-server/chat2db-community-spi/src/main/java/ai/chat2db/spi/DefaultSqlBuilder.java

@@ -216,7 +216,11 @@ private String generateCommentSql(TableColumn column) {
         script.append(SQL_COMMENT_COLUMN);
         script.append(column.getTableName() + SQLConstants.DOT + column.getName());
         script.append(SQLConstants.SQL_IS_SINGLE_QUOTE);
-        script.append(column.getComment());
+        String comment = column.getComment();
+        // SQL-standard single-quote doubling; avoids breaking DDL on apostrophes
+        // (and prevents literal breakout) without doubling backslashes (which
+        // would corrupt comments on standard-conforming dialects).
+        script.append(comment == null ? "" : comment.replace("'", "''"));
         script.append(SQLConstants.SINGLE_QUOTE_SEMICOLON_LINE_SEPARATOR);
         return script.toString();
     }

chat2db-community-server/chat2db-community-spi/src/main/java/ai/chat2db/spi/util/DBStructUtils.java

@@ -62,7 +62,7 @@ protected static String generateCreateTableSQL(String tableName, List<TableColum
             Integer columnSize = column.getColumnSize();
             Integer decimalDigits = column.getDecimalDigits();
             String columnComment = column.getComment();
-            String commentClause = (columnComment != null && !columnComment.isEmpty()) ? " COMMENT '" + columnComment + "'" : "";
+            String commentClause = (columnComment != null && !columnComment.isEmpty()) ? " COMMENT '" + columnComment.replace("'", "''") + "'" : "";
             String columnDefinition = columnName + " " + dataType;
 
             if ((StringUtils.equalsIgnoreCase(dataType, "VARCHAR") || StringUtils.equalsIgnoreCase(dataType, "CHAR")) && columnSize != null) {
@@ -136,13 +136,16 @@ private static String generateUpateTableColumnSQL(TableColumn tableColumn) {
             return "ALTER TABLE " + tableColumn.getTableName() + " MODIFY COLUMN " + tableColumn.getName() + " " + tableColumn.getColumnType() + ";";
         }
         if (tableColumn.getComment() != null) {
-            return "COMMENT ON COLUMN " + tableColumn.getTableName() + "." + tableColumn.getName() + " IS '" + tableColumn.getComment() + "';";
+            return "COMMENT ON COLUMN " + tableColumn.getTableName() + "." + tableColumn.getName() + " IS '" + tableColumn.getComment().replace("'", "''") + "';";
         }
         return "";
     }
 
     private static String generateTableCommentSQL(String tableName, String comment) {
-        return "COMMENT ON TABLE " + tableName + " IS '" + comment + "';";
+        if (comment == null) {
+            return "COMMENT ON TABLE " + tableName + " IS NULL;";
+        }
+        return "COMMENT ON TABLE " + tableName + " IS '" + comment.replace("'", "''") + "';";
     }
 
 }

chat2db-community-server/chat2db-community-spi/src/test/java/ai/chat2db/spi/DefaultSqlBuilderSegmentTest.java

@@ -6,6 +6,7 @@
 import ai.chat2db.community.domain.api.model.metadata.Database;
 import ai.chat2db.community.domain.api.model.metadata.Schema;
 import ai.chat2db.community.domain.api.model.metadata.Table;
+import ai.chat2db.community.domain.api.model.metadata.TableColumn;
 import ai.chat2db.community.domain.api.model.result.Header;
 import ai.chat2db.community.domain.api.model.result.ResultOperation;
 import ai.chat2db.spi.model.datasource.ConnectInfo;
@@ -66,6 +67,23 @@ void buildsDdlThroughUnifiedSegment() {
                 builder.ddl().table().buildTruncateTable(new TruncateTableRequest("app", "public", "users")));
     }
 
+    @Test
+    void buildCreateTableEscapesCommentQuotesWithoutChangingBackslashes() {
+        TableColumn column = new TableColumn();
+        column.setName("name");
+        column.setTableName("users");
+        column.setColumnType("VARCHAR");
+        column.setNullable(1);
+        column.setComment("O'Brien\\docs");
+        Table table = new Table();
+        table.setName("users");
+        table.setColumnList(List.of(column));
+
+        String sql = builder.ddl().table().buildCreateTable(table, TableBuilderConfig.defaultConfig());
+
+        assertTrue(sql.contains("COMMENT ON COLUMN users.name IS 'O''Brien\\docs';"), "actual sql: <" + sql + ">");
+    }
+
     @Test
     void buildsDmlThroughUnifiedSegment() {
         assertEquals("",

chat2db-community-server/chat2db-community-spi/src/test/java/ai/chat2db/spi/util/DBStructUtilsTest.java

@@ -1,5 +1,6 @@
 package ai.chat2db.spi.util;
 
+import ai.chat2db.community.domain.api.model.metadata.Table;
 import ai.chat2db.community.domain.api.model.metadata.TableColumn;
 import org.junit.jupiter.api.Test;
 
@@ -80,4 +81,45 @@ CREATE TABLE users (
                 \texpr VARCHAR(10)
                 );""", DBStructUtils.generateCreateTableSQL("users", List.of(column)));
     }
+
+    @Test
+    void generateCreateTableSQLEscapesCommentQuotesWithoutChangingBackslashes() {
+        TableColumn column = new TableColumn();
+        column.setName("name");
+        column.setColumnType("VARCHAR");
+        column.setComment("O'Brien\\docs");
+
+        String sql = DBStructUtils.generateCreateTableSQL("users", List.of(column));
+
+        assertEquals("""
+                CREATE TABLE users (
+                \tname VARCHAR COMMENT 'O''Brien\\docs'
+                );""", sql);
+    }
+
+    @Test
+    void buildAlterTableUsesNullToRemoveTableComment() {
+        Table oldTable = table("existing");
+        Table newTable = table(null);
+
+        assertEquals("COMMENT ON TABLE users IS NULL;\n", DBStructUtils.buildAlterTable(oldTable, newTable));
+    }
+
+    @Test
+    void buildAlterTableEscapesTableCommentQuotesWithoutChangingBackslashes() {
+        Table oldTable = table("existing");
+        Table newTable = table("O'Brien\\docs");
+
+        assertEquals("COMMENT ON TABLE users IS 'O''Brien\\docs';\n",
+                DBStructUtils.buildAlterTable(oldTable, newTable));
+    }
+
+    private static Table table(String comment) {
+        Table table = new Table();
+        table.setName("users");
+        table.setComment(comment);
+        table.setColumnList(List.of());
+        table.setIndexList(List.of());
+        return table;
+    }
 }