在sqlite数据库上的游标查询错误

Question

I am trying to get column info from a cursor, and getting a frustrating error. I want to select all columns containing $SEARCH. Here is the code:

Bundle b = getIntent().getExtras();
        SEARCH = b.getString("searchtext");
        Cursor c = mDBHelper.getReadableDatabase().query("table", null, "name="+ SEARCH, null, null, null, null);

For some reason, the cursor is throwing a runtime exception. here is the error:

12-30 03:55:00.357: E/AndroidRuntime(1302): Caused by: android.database.sqlite.SQLiteException: near "CAP": syntax error: , while compiling: SELECT * FROM kroger WHERE name=john

Not sure why this is happening, there's probably a very simple error in my code, but I'm not sure what it is. THanks for your help!

Answer 1

"name="+SEARCH will become name=CAP , which isn't a valid SQL expression. The naïve solution is to wrap the term in single-quotes:

"name='" + SEARCH + "'"

But this is subject to SQL injection attacks. Use the argument-passing facilities to pass the search term in an injection-free manner:

query("table", null, "name=?", new String[] {SEARCH}, null, null, null);