* insertsql＆* querysql階段的語法錯誤階段

-1

- (BOOL) saveData:(NSString*)registerNumber name:(NSString*)name 
        department:(NSString*)department year:(NSString*)year; 
    { 
    const char *dbpath = [databasePath UTF8String]; 
    if (sqlite3_open(dbpath, &database) == SQLITE_OK) 
    { 
    //here syntax error comes.. 
    NSString *insertSQL = [NSString stringWithFormat:@ "insert into studentsDetail (regno,name, department, year) values ("\"%d\",\"%@\", \"%@\", \"%@\")",[registerNumber integerValue],name, department, year]; 
    const char *insert_stmt = [insertSQL UTF8String]; 
    sqlite3_prepare_v2(database, insert_stmt,-1, &statement, NULL); 

    if (sqlite3_step(statement) == SQLITE_DONE) 
     { 
      return YES; 
     }else { 
      return NO; 
     } 
      sqlite3_reset(statement); 
     } 
      return NO; 
     } 

- (NSArray*) findByRegisterNumber:(NSString*)registerNumber 
    { 
     const char *dbpath = [databasePath UTF8String]; 
     if (sqlite3_open(dbpath, &database) == SQLITE_OK) 
     { 
      NSString *querySQL = [NSString stringWithFormat:"select name, department, year from studentsDetail where regno=\"%@\" ",registerNumber]; 
      const char *query_stmt = [querySQL UTF8String]; 
      NSMutableArray *resultArray = [[NSMutableArray alloc]init]; 

      if (sqlite3_prepare_v2(database,query_stmt, -1, &statement, NULL) == SQLITE_OK) 
      { 
       if (sqlite3_step(statement) == SQLITE_ROW) 
        { 
        NSString *name = [[NSString alloc] initWithUTF8String:(const char *) sqlite3_column_text(statement, 0)]; 
        [resultArray addObject:name]; 
        NSString *department = [[NSString alloc] initWithUTF8String:(const char *) sqlite3_column_text(statement, 1)]; 
        [resultArray addObject:department]; 
        NSString *year = [[NSString alloc]initWithUTF8String:(const char *) sqlite3_column_text(statement, 2)]; 
        [resultArray addObject:year]; 
        return resultArray; 
        }else{ 
         NSLog(@"Not found"); 
         return nil; 
        } 
        sqlite3_reset(statement); 
       } 
       } 
      return nil; 
     }

階段*insertsql & *querysql的語法錯誤。這裏SQL表是動態創建的&插入值在sql表上。我沒有更多的SQL知識。* insertsql＆* querysql階段的語法錯誤階段

來源

2013-06-04 Renish Dadhaniya

你讀過我的回答你以前的問題http://stackoverflow.com/questions/16916743/syntax-error-at-const-char-sql-stmt？這裏似乎是完全一樣的錯誤。 –

該問題已被編輯，以便**原始問題不再可見**。（錯誤地將字符串常量分割成多行，與前面的問題相同。） –

此字串

NSString *insertSQL = [NSString stringWithFormat:@ "insert into studentsDetail (regno,name, department, year) values (\"\"%d\",\"%@\", \"%@\", \"%@\")",[registerNumber integerValue], 
             name, department, year];

來源

2013-06-04 12:29:28

SQL注入警報！ SQL注入警報！ – trojanfoe

使用此字符串。

NSString *insertSQL = [NSString stringWithFormat:@ "insert into studentsDetail (regno,name, department, year) values (\"%d\",\"%@\", \"%@\", \"%@\")",num,name, department, year];

我想你已經添加了額外的"之前\"%d\"所以我必須刪除它在我的字符串嘗試，如果它幫助。

來源

2013-06-04 12:37:12 Dilip

SQL注入警報！ SQL注入警報！ – trojanfoe

@trojanfoe我剛剛糾正了字符串語法錯誤。就這樣。 – Dilip

這仍然是不好的做法;鼓勵OP使用綁定變量。 – trojanfoe

* insertsql＆* querysql階段的語法錯誤階段

回答

相關問題