How to run away? data that is inserted into the sqlite database.

Question

I am making an apple application using the space of the phone (which uses the sqlite database).

All my inserts work fine, except when I try to insert a web link. These are errors because there are “characters in the web link”.

Using the following:

var content = 'hello, this is my <a href="www.google.com">link</a>' tx.executeSql('UPDATE PAGES SET content="'+content+'" WHERE id="1"'); 

Returns the following error

 error code 1 error: "near "http": syntax error" 

If I delete the website address, I will not get an error. I tried: content = escape (content);

but it didn’t work.

Answer 1

Use parameter binding. This is the right and safest way to do what you are trying to do.

 tx.executeSql('UPDATE PAGES SET content=? WHERE id=1', [content]); 

Answer 2

To avoid quotes in SQLite, you will have to repeat quotes.

So, to insert a 7" screen , you have to put a 7"" screen in the INSERT statement.

Answer 3

The problem is the quotation marks. They change the value of the SQL query and cause an error.

I can not find any information on how to properly screen them. I read that you can put \ in front of them and then add ESCAPE ("\") to the SQL statement, but this does not seem to work with the PhoneGap implementation.

In the end, I made a simple replacement where single or double quotes are replaced with " , eg:

 var thisNotes = $('textarea#notes').val().replace(/(["'])/g,'"'); 

I just need to display quotes in the text box, but I don’t need them as part of the HTML link, so I'm not sure if the link will work. You may need to cancel the replacement before displaying the link.

Hope this helps.

Answer 4

use javascript replace, perhaps create a function like this:

 function CleanDbData( dirty ){ var clean = dirty.replace( "/"","''").replace("<script>","[script]"); return clean; } var mydata = CleanDbData( dirtydata ); 

this is not AS, you have to mess with regex, etc., but you get the idea [hope]