简体繁体 English

在Basic4android中长的多变量SQL请求中加引号

[英]Quotes in a long multi-variable SQL request in Basic4android

原文 2011-11-02 16:27:10 8 1 sql/ quote/ basic4android

All B2A users. 所有B2A用户。

Again about double quotes in SQL: how to be (replace quotes) in B2A long SQL INSERT\\UPDATE request string, if this string is created dinamically, fields names and qty are variables (download by HTTP), and any value of them can be a string with quotes ? 关于SQL中的双引号：在B2A长SQL INSERT \\ UPDATE请求字符串中如何（替换引号），如果该字符串是动态创建的，则字段名称和数量是变量（通过HTTP下载），并且它们的任何值都可以是带引号的字符串？ Fields values are also in double quotes for INSERT, and I mean that whole the big SQL string cannot be easy formatted as string with & QUOTE & parts. 字段值也在INSERT中用双引号引起来，我的意思是说，整个大SQL字符串都很难用＆QUOTE＆part格式化为字符串。

B4A gives SQLite exception "sintax error". B4A给出SQLite异常“ sintax错误”。 Quotes in the values must be saved\\used.... :-( not to be replaced by two single quotes. What more symbols in the fields values must be specially checked (excepting destructive SQL injections...)? 值中的引号必须保存\\使用.... :-(不能用两个单引号代替。必须特别检查字段值中还有哪些符号（破坏性SQL注入...除外）？

1 个解决方案

The solution is to use parameterized queries with ExecQuery2 or ExecNonQuery2. 解决方案是将参数化查询与ExecQuery2或ExecNonQuery2一起使用。 SQL docs . SQL文档。 You can also use DBUtils . 您也可以使用DBUtils 。