Question

i found 2 different ways to create a NSPredicate.

Way 1:

NSExpression *exprName = [NSExpression expressionForKeyPath:@"name"];
NSExpression *exprFilter = [NSExpression expressionForConstantValue: name ]; 
NSPredicate *predicate = [NSComparisonPredicate predicateWithLeftExpression: exprName 
                                                              rightExpression: exprFilter 
                                                                     modifier: NSDirectPredicateModifier  
                                                                         type: NSContainsPredicateOperatorType 
                                                                      options: NSCaseInsensitivePredicateOption];       

Way 2:

NSPredicate *predicate = [NSPredicate predicateWithFormat:@"name CONTAINS[c] %@", name];

What is the best way to create a NSPredicate and also prevent SQLInjection?

Answer 1

The first way is useful if you are setting up a complex predicate programmatically. Other than that, the second way is fine. You don’t have to worry about SQL injection with Core Data.

relevant

also relevant