Question

I have to insert a string into a sqlite data base
my command ..

Err=sqlite_exec(DB, "create table tbl5(TEXT varchar(100));", xCallback, (void*)"First Test", &ErrMsg);

Err=sqlite_exec(DB, "insert into tbl5 values  ('some string');", xCallback, (void*)"First Test", &ErrMsg); 

works fine but when I want to put s="some string" ie

Err=sqlite_exec(DB, "insert into tbl5 values  (s);", xCallback, (void*)"First Test", &ErrMsg); 

then this is not working so how to add variable then It is not working so how to insert variable in sqlite database
thank u

Answer 1

Don’t use sprintf() but sqlite3_mprintf(). Here is the documentation.

char s[20] = "some string";
char* query = sqlite3_mprintf("insert into tbl5 values ('%q');", s);

Otherwise you have a risk of SQL injection.

The resulting query string should be freed using sqlite3_free().

Also note the '%q' instead of the usual '%s'.