上海做网站公司哪家好,建筑公司有哪些部门和职位,小程序应用开发,服装网页设计模板图片sqlite中#xff0c; 在使用sql语句写入字符串数据时#xff0c; 由于字符数据中可能隐含转义字符#xff0c;如果对于他们不作处理#xff0c;执行时#xff0c;exec函数将不识别#xff0c;或者造成注入攻击这个时候sqlite_mprintf(),应该就是必须使用了#xff0c;配…sqlite中
在使用sql语句写入字符串数据时 由于字符数据中可能隐含转义字符 如果对于他们不作处理执行时exec函数将不识别或者造成注入攻击这个时候sqlite_mprintf(),应该就是必须使用了配合‘%q’将字符数据中的转义字符直接转换就不用担心字符串中含有‘单引号这样造成sql语句不识别的问题。For example, assume the string variable zText contains text as follows: char *zText Its a happy day!;One can use this text in an SQL statement as follows: char *zSQL sqlite3_mprintf(INSERT INTO table VALUES(%q), zText);
sqlite3_exec(db, zSQL, 0, 0, 0);
sqlite3_free(zSQL);Because the %q format string is used, the \ character in zText is escaped and the SQL generated is as follows: INSERT INTO table1 VALUES(Its a happy day!) This is correct. Had we used %s instead of %q, the generated SQL would have looked like this: INSERT INTO table1 VALUES(Its a happy day!)
