Android Question Sqlite saveing

[TomDuncan]

Hi All,
I have a program which does this

SQL.ExecNonQuery("UPDATE daytimes SET patient = '" & DataToSave & "', modified = 1 " & Where)

Where DataToSave is a String.
All is fine till today when testing I put in
Tom's birthday.
What has happened is the ' for Tom has corrupted the data being saved.
How can I fix this error.

I did think of Encoding Base 64 but then all previous data would not work.

Tom

oops Saving, sorry about that

 

[sorex]

you need to escape your DataToSave string.

SQL.ExecNonQuery("UPDATE daytimes SET patient = '" & DataToSave.replace("'","\'") & "', modified = 1 " & Where)

 

[TomDuncan]

Thanks for that, will do.

 

[Mahares]

If you do not want to worry about escaping, you are better off using a parameterised query:

SQL.ExecNonQuery2("UPDATE daytimes SET patient = ?, modified = ? " & Where), _
        Array As Object(DataToSave, 1))

 

[Erel]

No. No. No.

You need to use parameterized queries:

SQL.ExecNonQuery2("UPDATE daytimes SET patient = ?, modified = 1 " & Where, Array (DataToSave))

Edit: Posted together with the post above which is a good solution.