No rows returned using SQLiteParameters, but rows returned with direct query
-
tried and failed. wait, using it without ' in the query string works. yes, thank you though I can still input % as a wildcard and get all rows. I thought this supposed to sanitize/escape input. guess I can live with it though, unless you have a better idea
-
do you know why the % char isnt being escaped?
-
do you know why the % char isnt being escaped?
-
yes, but if it's put into the textbox, it's queried as LIKE %%% which matches everything
-
yes, but if it's put into the textbox, it's queried as LIKE %%% which matches everything
-
it's a search query for a database, text input box
-
it's a search query for a database, text input box
Yes, but that has nothing to do with creating a valid SQL statement. The textbox is provided by the user, so your code should verify that it contains valid data. You then take the validated text and store into one of the SQL Parameters which get passed in to he execution module. Do not assume that the user knows what he or she is doing and just accept whatever they type. Many times it will be wrong, mist-typed, not understanding what is required, etc.
-
Yes, but that has nothing to do with creating a valid SQL statement. The textbox is provided by the user, so your code should verify that it contains valid data. You then take the validated text and store into one of the SQL Parameters which get passed in to he execution module. Do not assume that the user knows what he or she is doing and just accept whatever they type. Many times it will be wrong, mist-typed, not understanding what is required, etc.
I thought SQLLiteParameter sanitizes or at least escapes special characters
-
I thought SQLLiteParameter sanitizes or at least escapes special characters
-
I thought SQLLiteParameter sanitizes or at least escapes special characters
Parameters don't "sanitize" or "escape" special characters. They pass parameters across completely separately from the command text, so that there is no way for the database engine to get confused and treat part of the parameter as part of the command. Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^] How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
"These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer