Question

I know how to put text into a sqlite3 table in objective c. This is how I’m doing it:

NSString *sql = [NSString stringWithFormat: @"INSERT OR REPLACE INTO myTable (name, response) VALUES ('%@','%@');", name, response];

char *err;
if (sqlite3_exec(db, [sql UTF8String], NULL, NULL, &err) != SQLITE_OK)
{
    sqlite3_close(db);
}

My big concern is that since the text I’m putting into the table is coming directly from the user, it could contain any characters, including things like apostrophes, which would need to be escaped before being put into the table.

I have two main questions:

1. Besides apostrophes, what other characters do I need to escape for sql text that a user might enter?
2. What is the best way to alter the NSString to put in escapes before the characters that need to be escaped, before putting it into the sql table? Should I just use a scanner and parse the string character by character searching for characters that should be escaped?

Thanks!

Answer 1

You should use the built in ? feature. You will need to create prepared statement, then use sqlite_3_bind_text.

"INSERT OR REPLACE INTO myTable (name, response) VALUES (?,?);"

I would also recommend looking into FMDB.