Question

I’m new here so I firstly like to say hello.

My problem is that I’m working on my game in Lua, when I want to update an value in my database it needs to be done dynamically (by the user) for example.

When the value in the database equals 1, the user may want to change that to 0 (when he sets the bloom off) .

I can do it hard coded by using:

for test in db:nrows("UPDATE test SET bloom = 1 WHERE bloom = 0") do

I would like to allow the users to change that value. But how can I do this?
I already have a placeholder for this which is

local bloom = 0

Answer 1

Use placeholders, as you should with any queries based on user input to avoid passing data as commands (aka SQL injections).

local stmt = db:prepare[[
  UPDATE test SET bloom = ? WHERE bloom = ?
]]
stmt:bind(new_bloom, previous_bloom)
stmt:exec()