Re: [sqlite] Re: How safe is sqlite3_prepare compared to sqlite3_exec?

2006-12-01 Thread Vitali Lovich
Try instead of "SELECT * FROM table WHERE name LIKE ?" as your sql query, "SELECT * FROM table WHERE name LIKE :comparison" Thomas Zangl wrote: Vitali Lovich schrieb: Regarding your code snippet: // SQL Statement is: "SELECT * FROM table WHERE name LIKE ?" search = '%test%'; sqlite3_bind_text

Re: [sqlite] Re: How safe is sqlite3_prepare compared to sqlite3_exec?

2006-11-30 Thread Trevor Talbot
On 11/30/06, Thomas Zangl <[EMAIL PROTECTED]> wrote: char* sql_parameter_search = '%test%' This is not valid C. If you want help with your code, paste EXACTLY what you're using please! - To unsubscribe, send email to

Re: [sqlite] Re: How safe is sqlite3_prepare compared to sqlite3_exec?

2006-11-30 Thread Thomas Zangl
Vitali Lovich schrieb: Regarding your code snippet: // SQL Statement is: "SELECT * FROM table WHERE name LIKE ?" search = '%test%'; sqlite3_bind_text(prepared_statement, 0,search , search , SQLITE_STATIC); First I'm not sure what language you're using - it seems Perl-like. Anyways, the documen

Re: [sqlite] Re: How safe is sqlite3_prepare compared to sqlite3_exec?

2006-11-30 Thread Vitali Lovich
Regarding your code snippet: // SQL Statement is: "SELECT * FROM table WHERE name LIKE ?" search = '%test%'; sqlite3_bind_text(prepared_statement, 0,search , search , SQLITE_STATIC); First I'm not sure what language you're using - it seems Perl-like. Anyways, the documentation for http://www.s

Re: [sqlite] Re: How safe is sqlite3_prepare compared to sqlite3_exec?

2006-11-30 Thread Thomas Zangl
Igor Tandetnik schrieb: Hi! Compare with this program: string userInput; string sql = "update UserPrefs set innocuousPref=? where userid=123;"; sqlite3_stmt* stmt; sqlite3_prepare(db, sql.c_str(), -1, &stmt, 0); sqlite3_bind_text(stmt, 1, userInput.c_str(), -1, SQLITE_STATIC); sqlite3_step(stmt