Android Question I write a test program to show that same SQLite files, some file can’t be read well. I need help.

Erel said:

6. You should use parameterized queries:
Change:

B4X:

Cursor1 = SQL1.ExecQuery("SELECT * FROM " & TableText & " WHERE ID = " & recordID)

To:

B4X:

Cursor1 = SQL1.ExecQuery2("SELECT * FROM " & TableText & " WHERE ID = ?", Array As String (recordID))

Click to expand...

Cursor1 = SQL1.ExecQuery2($"SELECT * FROM ${TableText} WHERE ID=?"$, Array As String(recordID))

'OR if recordID is an Int (so guaranteed not to have any special chars in it):

Cursor1 = SQL1.ExecQuery($"SELECT * FROM ${TableText} WHERE ID=${recordID}"$)

Computersmith64 said:

OR if recordID is an Int (so guaranteed not to have any special chars in it):

Click to expand...

$"SELECT * FROM ${TableText} WHERE ID = ${ListOfObjects.Get(i))}"$

Erel said:

It is still better to use ExecQuery2.
1. It is a good habit.
2. It is safe from SQL injection. It is true that if recordID is an Int then it is not relevant but good practices protect us from future changes.

For example:

B4X:

$"SELECT * FROM ${TableText} WHERE ID = ${ListOfObjects.Get(i))}"$

Or later you decide to make ID a string instead of an int.

Click to expand...