How to avoid SQL injection in javascript textbox?

Question

I have javascript code accessing sqlite3 database. I would like to check the value of the text field and prevent SQL injection. Is there an “optimal algorithm” for this?

- update: I am developing a Xulrunner desktop application. Perhaps I should use the database in the xpcom component that is compiled (written in C), so the user will not have access to it.

Answer 1

Normally, SQL injection is eliminated using parameterized SQL statements.

Here's an MSDN article describing how you do this.

SQL.

Answer 2

SQL- , , .

Answer 3

, , , - JavaScript , .., , , . , , , , , , .