Including variables into DBUtils queries.

[copiloto]

Hello,

using DBUtils, I got a dude:

How could it be possible to include a variable into Query like this:


dim mytext as text
mytext="hi"

wv.LoadHtml(DBUtils.ExecuteHtml(SQL1, "SELECT * FROM devices WHERE field1 LIKE %mytext%, Null, 0,True))

Thanks in advance.

 

[Ricky D]

Dim mytext As String
 mytext="hi"
wv.LoadHtml(DBUtils.ExecuteHtml(SQL1, "SELECT * FROM devices WHERE field1 LIKE %" & mytext & "%", Null, 0,True))

cheers, Ricky

 

[Jost aus Soest]

...and don't forget to prevent SQL-injection, e. g. by filtering Quotes!

 

[copiloto]

Thanks very much Ricky D and Jost aus Soest !! Now it's possible to continue my project!

I am very grateful to you. My "little" project is: using services (I'm learning in these days about it), it'll be detected that every month, it has to be refreshed a DB located in a web. (it has to be detected calendary changes) Then it'll be automatically downloaded, and after it'll be created a near 30.000 registers SQL DB. Finally it has to be detected prices changes.
When my wife opens app, it'll be showed first an alfabetically ordered list of that changes. Of course, the main purpose is searching for several products into the SQL database at quickest speed, so DBUtils will be very appreciated

Jost aus Soest, could you explain (if possible ), how to prevent SQL injection? Although it'll be a simple home app, I'm curious about it, because heard so much times about prevent SQL injection.

Best regards to both of you!