Question

The follow is my db function:

+(NSArray*)searchWithKey:(NSString*)_key{
NSMutableArray* tmpArray = [NSMutableArray array];
static Statement* stmt = nil;
char* sql = "select * from Bookmarks where BMUrl like '%?%'";
if (stmt == nil) {
    stmt = [DBConnection statementWithQuery:sql];
    [stmt retain];
}
[stmt bindString:_key forIndex:1];
while ([stmt step] == SQLITE_ROW) {
    BookMark* tmpBM = [[BookMark alloc] initWithStatement:stmt];
    NSLog(@"tmpBM = %@",tmpBM);
    [tmpArray addObject:tmpBM];
    [tmpBM release];
}
[stmt reset];
return tmpArray;}

The keyword of sql is “like” which I use.But there are no results that the sqlite return.Anyone could tell me why?
I change the sql into “select * from Bookmarks where BMUrl like ‘%h%'”,there are some results which are returned.So , I guess the mistake is the function “bindString:forIndex”,the code is

- (void)bindString:(NSString*)value forIndex:(int)index{
sqlite3_bind_text(stmt, index, [value UTF8String], -1, SQLITE_TRANSIENT);}

which is the correct sqlite3 api that i will use? thank u!

Answer 1

Bindings aren’t interpolated like that. If you put a quotation mark in a string, as in '%?%', it will be interpreted as a literal question mark.

You should instead modify your input _key:

• Escape any instances of % and _ with a \
• Add %s at the beginning and end

This prepares it to be used with a LIKE operator.

You also need to modify your SQL so that the ? represents a standalone parameter: ... where BMUrl like ?.

---

Here’s an example for how to escape special characters and add %s at the beginning and end of _key:

NSString *escapedKey = [_key stringByReplacingOccurencesOfString:@"%" 
                                                      withString:@"\\%"];
escapedKey = [escapedKey stringByReplacingOccurencesOfString:@"_"
                                                  withString:@"\\_"];
NSString *keyForLike = [NSString stringWithFormat:@"%%%@%%", escapedKey];
[stmt bindString:keyForLike forIndex:1];