javascript - Apostrophe breaking insert query in SQLite in Titanium -
this question has answer here:
- how can prevent sql injection in php? 28 answers
i writing application in javascript using appcelerator's titanium development platform deploy android mobile platform. trying perform insert
sqlite database.
the strings whenever have single quote or apostrophe entered user breaks insert query. doing wrong?
var db = ti.database.install('db/kewgarden.sqlite', 'kewgarden'); var drivebydata = { "notes" : $.row3.getvalue() // user entered string }; drivebydata = json.stringify(drivebydata); dblib.saverecording(savedrivebydetailssuccess, savedrivebydetailserror, { ref_id : newdrivebyid, tablename : tablename, data : drivebydata }); saverecording : function(onsuccesscallback, onerrorcallback, options) { var strreplacedata = options.data.replace("'", "\'"); db.execute("insert g_temp (ref_id, table_name, data, site) values (" + options.ref_id + ",'" + options.tablename + "','" + strreplacedata + "','" + options.site + "')"); },
the docs database here:
http://docs.appcelerator.com/platform/latest/#!/api/titanium.database.db-method-execute
use parameters, don't need escape anything:
db.execute('insert mytable(id, name) values(?, ?)', 123, name);
your query this,
db.execute('insert g_temp (ref_id, table_name, data, site) values (?,?,?,?)',options.ref_id,options.tablename,options.data,options.site);
Comments
Post a Comment