适用于 iOS 的 Sqlite 语句
我正在尝试创建一个包含多个列的表。我正在尝试绑定值（这是一个变量）来创建表名。我不断收到错误：('创建更新语句时出错。'near "?": 语法错误'') 所以显然我在尝试绑定它时做错了。有人能为我解释一下吗？
- (void)addTable{
NSString *cat = sourceName;
if(addtablestmt == nil) {
const char *sqlStr = "CREATE Table ? ('itemID' 'integer','itemName' 'char(50)','itemCategory' 'char(50)','itemCount' 'integer','itemDone' 'char(50)','itemNote' 'char(50)','itemOrder' 'char(50)',PRIMARY KEY (itemID))";
if(sqlite3_prepare_v2(database, sqlStr, -1, &addtablestmt, NULL) != SQLITE_OK)
NSAssert1(0, @"Error while creating update statement. '%s'", sqlite3_errmsg(database));
sqlite3_bind_text(addtablestmt, 1, [cat UTF8String], -1, SQLITE_TRANSIENT);
}
if(SQLITE_DONE != sqlite3_step(addtablestmt)){
NSAssert1(0, @"Error while updating. '%s'", sqlite3_errmsg(database));
}
sqlite3_reset(addtablestmt);
}
I am trying to create a table with a number of columns. I am trying to bind the value (which is a variable) to create the table name. I keep getting an error: ('Error while creating update statement. 'near "?": syntax error'') So obviously I am doing something wrong with trying to bind it. Can anyone shed some light on this for me?
- (void)addTable{
NSString *cat = sourceName;
if(addtablestmt == nil) {
const char *sqlStr = "CREATE Table ? ('itemID' 'integer','itemName' 'char(50)','itemCategory' 'char(50)','itemCount' 'integer','itemDone' 'char(50)','itemNote' 'char(50)','itemOrder' 'char(50)',PRIMARY KEY (itemID))";
if(sqlite3_prepare_v2(database, sqlStr, -1, &addtablestmt, NULL) != SQLITE_OK)
NSAssert1(0, @"Error while creating update statement. '%s'", sqlite3_errmsg(database));
sqlite3_bind_text(addtablestmt, 1, [cat UTF8String], -1, SQLITE_TRANSIENT);
}
if(SQLITE_DONE != sqlite3_step(addtablestmt)){
NSAssert1(0, @"Error while updating. '%s'", sqlite3_errmsg(database));
}
sqlite3_reset(addtablestmt);
}
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以尝试更像这样的事情：
You might try something more like:
您不能将表名称绑定为参数。如果您打算这样做，那么您需要按照 Joe 的建议动态创建字符串。但要小心，因为这种方法可能会导致 SQL 注入攻击。例如，用户可以输入名称“；从 sqlite_master 中删除”。
You cannot bind table name as a parameter. If you are planning on doing that, then you need to dynamically create the string as suggested by Joe. However be careful as that approach could lead to sql injection attacks. For ex a user could enter a name "; Delete from sqlite_master".