Knoppi Active Member Licensed User Longtime User Oct 25, 2018 #1 Code: SQL.ExecNonQuery2( "INSERT INTO test VALUES ( ?)", Array As Object( "TEST")) 'this works SQL.ExecNonQuery2( "INSERT INTO ? VALUES ( 'TEST')", Array As Object( "test")) 'but this fails org.sqlite.SQLiteException: [SQLITE_ERROR] SQL error or missing database (near "?": syntax error) Click to expand... I need a few hints why the second command does not work
Code: SQL.ExecNonQuery2( "INSERT INTO test VALUES ( ?)", Array As Object( "TEST")) 'this works SQL.ExecNonQuery2( "INSERT INTO ? VALUES ( 'TEST')", Array As Object( "test")) 'but this fails org.sqlite.SQLiteException: [SQLITE_ERROR] SQL error or missing database (near "?": syntax error) Click to expand... I need a few hints why the second command does not work
Daestrum Expert Licensed User Longtime User Oct 25, 2018 #2 I dont think the tablename can be a parameter. You could use something like Code: Dim Table_Name as String = "test" … SQL.ExecNonQuery2( $"INSERT INTO ${Table_Name} VALUES (?)"$, Array As Object( "TEST")) Upvote 0
I dont think the tablename can be a parameter. You could use something like Code: Dim Table_Name as String = "test" … SQL.ExecNonQuery2( $"INSERT INTO ${Table_Name} VALUES (?)"$, Array As Object( "TEST"))
Erel B4X founder Staff member Licensed User Longtime User Oct 25, 2018 #3 Tips: 1. Tou can write Array instead of Array As Object. It is the same thing. 2. @Daestrum answer is 100% correct. You should however know that the query is no longer safe from SQL injections. If the table name somehow comes from user input then you should think about it. Upvote 0
Tips: 1. Tou can write Array instead of Array As Object. It is the same thing. 2. @Daestrum answer is 100% correct. You should however know that the query is no longer safe from SQL injections. If the table name somehow comes from user input then you should think about it.
