SQLite3 - SQL 錯誤：無法識別的令牌：C 的“”

Question

我知道這已在 SQLite 語句中的 Unrecognized token 中得到回答，但我不明白我們如何使用“？” 對於 SQLite 使用 C。

我正在這樣做-

        rc = sqlite3_open("test.db", &db);

        if(rc) {
            debug_log("Can't open database: %s\n", sqlite3_errmsg(db));                                                                                                                                  rv = 3;
            goto end;
        } else {
            debug_log("Opened database successfully\n");
        }

        querylen = strlen("SELECT * from HMAC WHERE path = %s AND checksum = %s;");
        pathlen  = strlen(path);                                                                                                                                                                     sql      = (char *)malloc(querylen + pathlen + strlen(hex));
        sprintf(sql, "SELECT * from HMAC WHERE path = \'%s\' AND checksum = \'%s\';", path, hex);

        fprintf(stderr, "%s\n", sql);
        /* Execute SQL statement */
        rc = sqlite3_exec(db, sql, callback, NULL, &zErrMsg);
                                                                                                                                                                                                     if (rc != SQLITE_OK ) {
            rv = 3;
            fprintf(stderr, "SQL error: %s\n", zErrMsg);
            sqlite3_free(zErrMsg);
            goto end;
        }

        if (checksum_matched == 1) {
            rv = 0;
        } else {
            rv = 1;
        }

        free(sql);
        sqlite3_close(db);

但是，當我嘗試檢索某些案例的數據時，我得到了 -

SELECT * from HMAC WHERE path = '/usr/share/monitors/SNMPDCA_monitor' AND checksum = '66ace8fa66362d2cbbd926aac0b47531a7113afca0ab68b6202ecf0a7eaa87a2';
SQL error: unrecognized token: ""

更新：添加對遇到相同問題的其他人的未來參考有用的內容。

    sqlite3_stmt *stmt;
    rc = sqlite3_open("/usr/lib/hmac-binaries/test.db", &db);
    if(rc) {
        debug_log("Can't open database: %s\n", sqlite3_errmsg(db));
        rv = 3;
        goto close_conn;
    } else {
        debug_log("Opened database successfully\n");
    }
    querylen = strlen("SELECT * from HMAC WHERE path=?;");
    sql      = (char *)malloc(querylen + 1);
    if (sql == NULL) {
        fprintf(stderr, "ENOMEM\n");
        rv = -1;
        goto close_conn;
    }
    sprintf(sql, "SELECT * from HMAC WHERE path=?;");
    rc = sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
    if (rc != SQLITE_OK) {
        fprintf(stderr, "error: %s\n", sqlite3_errmsg(db));
        rv = 3;
        goto close_conn;
    } else {
        sqlite3_bind_text(stmt, 1, path, -1, NULL);
    }
    rv = 1;
    while ((rc = sqlite3_step(stmt)) == SQLITE_ROW) {
        if (strcmp(sqlite3_column_text(stmt, 3), hex) == 0) {
            rv = 0;
            break;
        }
    }
    if (rv != 0 && rc != SQLITE_DONE) {
        rv = 3;
    }
    sqlite3_finalize(stmt);
close_conn:
    if (sql)
        free(sql);
    sqlite3_close(db);

Answer 1

在 SQLite API 中，問號 ( ? ) 用作占位符，后來被實際值替換。 這用於創建准備好的語句，如文檔中所述。

您帖子中的源代碼不包含使用准備好的語句的示例，因此我將附上一個最小示例：

#include <sqlite3.h>
#include <stdio.h>

int main(void) {
  sqlite3 *db;
  char *err_msg = 0;
  sqlite3_stmt *res;

  int rc = sqlite3_open("test.db", &db);
  if (rc != SQLITE_OK) {
    fprintf(stderr, "Cannot open database: %s\n", sqlite3_errmsg(db));
    sqlite3_close(db);
    return 1;
  }

  // The question mark is used to provide an Id to the SQL query. 
  const char *sql = "SELECT Id, Name FROM Cars WHERE Id = ?";

  //  The sqlite3_prepare_v2() function compiles the SQL query. 
  rc = sqlite3_prepare_v2(db, sql, -1, &res, 0);

  if (rc == SQLITE_OK) {
    // The sqlite3_bind_int() binds an integer value to the prepared statement.
    // The placeholder is replaced with integer value 3. The function's second
    // parameter is the index of the SQL parameter to be set and the third 
    // parameter is the value to bind to the parameter.
    sqlite3_bind_int(res, 1, 3);
  } else {
    fprintf(stderr, "Failed to execute statement: %s\n", sqlite3_errmsg(db));
  }

  // The sqlite3_step() function evaluates the SQL statement. 
  int step = sqlite3_step(res);
  if (step == SQLITE_ROW) {
    printf("%s: ", sqlite3_column_text(res, 0));
    printf("%s\n", sqlite3_column_text(res, 1));
  }

  sqlite3_finalize(res);
  sqlite3_close(db);
  return 0;
}

I suggest you read the official SQLite C API and the SQLite C tutorial for more examples of using prepared statements.