sqlite中， 在使用sql語句寫入字符串?dāng)?shù)據(jù)時(shí)， 由于字符數(shù)據(jù)中可能隱含轉(zhuǎn)義字符， 如果對(duì)于他們不作處理，執(zhí)行時(shí)，exec函數(shù)將不識(shí)別，或者造成注入攻擊 這個(gè)時(shí)候sqlite_mprintf(), 應(yīng)該就是必須使用了，配合‘%q’將字符數(shù)據(jù)中的轉(zhuǎn)義字符，直接轉(zhuǎn)換， 就不用擔(dān)心字符串中含有‘單引號(hào)，這樣造成sql語句不識(shí)別的問題。

For example, assume the string variable zText contains text as follows:

char *zText = "It's a happy day!";

One can use this text in an SQL statement as follows:

char *zSQL = sqlite3_mprintf("INSERT INTO table VALUES('%q')", zText); sqlite3_exec(db, zSQL, 0, 0, 0); sqlite3_free(zSQL);

Because the %q format string is used, the '\'' character in zText is escaped and the SQL generated is as follows:

INSERT INTO table1 VALUES('It''s a happy day!')

This is correct. Had we used %s instead of %q, the generated SQL would have looked like this:

INSERT INTO table1 VALUES('It's a happy day!')

總結(jié)

以上是生活随笔為你收集整理的Sqlite SQL格式化输入函数splite3_mprintf的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。