Question

I’m trying to insert data into SQLite using Phonegap.

Its working fine when hard coded as below

tx.executeSql('DROP TABLE IF EXISTS DEMO');
tx.executeSql('DROP TABLE IF EXISTS DEMO');
tx.executeSql('CREATE TABLE IF NOT EXISTS DEMO (id unique, data)');
tx.executeSql('INSERT INTO DEMO (id, data) VALUES (1, "First row")');
tx.executeSql('INSERT INTO DEMO (id, data) VALUES (2, "Second row")');

but when I try to insert a dynamic value from the form as below

var third = $('#data').val();
alert(third);
tx.executeSql('INSERT INTO DEMO (id, data) VALUES (3,'+ third +')');

I get an exception in logcat as below

04-18 12:20:51.011: I/SqliteDatabaseCpp(7352): sqlite returned: error code = 1, msg = no such column: test, db=/data/data/com.eyepax.phonegap/databases/webview.db

I’m so lost and couldn’t figure out the issue. Can someone help me out please.

full js file goes as below

function onDeviceReadyStorage() {
        var db = window.openDatabase("Database", "1.0", "Cordova Demo", 200000);
        db.transaction(populateDB, errorCB, successCB);

    }

function populateDB(tx) {
     tx.executeSql('DROP TABLE IF EXISTS DEMO');
     tx.executeSql('CREATE TABLE IF NOT EXISTS DEMO (id unique, data)');
     tx.executeSql('INSERT INTO DEMO (id, data) VALUES (1, "First row")');
     tx.executeSql('INSERT INTO DEMO (id, data) VALUES (2, "Second row")');
     var third = $('#data').val();
     alert(third);
     tx.executeSql('INSERT INTO DEMO (id, data) VALUES (3,'+ third +')');
}

function errorCB(err) {
    alert("Error processing SQL: "+err.code);
}

function successCB() {
    alert("success!");
    alert("now query...");
    var db = window.openDatabase("Database", "1.0", "Cordova Demo", 200000);
        db.transaction(queryDB, errorCB);
}

function queryDB(tx) {
        tx.executeSql('SELECT * FROM DEMO', [], querySuccess, errorCB);
       // alert("came to query");
    }

function querySuccess(tx, results) {
        //alert("Query sucess");
        // this will be empty since no rows were inserted.
        console.log("Insert ID = " + results.rows.item(0).data);
        // this will be 0 since it is a select statement
        console.log("Rows Affected = " + results.rowsAffected);
        // the number of rows returned by the select statement
       console.log("Insert ID = " + results.rows.length);
       var htmlString = "<ul>";
       for(var i = 0; i<results.rows.length; i++){
           console.log("Result from DB = " + results.rows.item(i).data);
            htmlString = htmlString + "<LI>"+ results.rows.item(i).data +"</LI>"   
       }
       htmlString = htmlString + "</UL>";

       $('#myDBData').html(htmlString);
    }

Answer 1

Try adding ” before and after the variable.
Like this:

tx.executeSql('INSERT INTO DEMO (id, data) VALUES (3,"'+ third +'")');

Edit:

Please refer to the comment below. To avoid the SQL injection vulnerability, follow the answer and use a ? placeholder instead of appending the value directly.