DbPrepareString - Revision history

Fernando187: Remove obsolete Requirements section

2024-11-07T17:14:02Z

Remove obsolete Requirements section

← Older revision		Revision as of 17:14, 7 November 2024
Line 44:		Line 44:

	</syntaxhighlight>		</syntaxhighlight>

	~~==Requirements==~~
	~~{{Requirements\|1.5.2\|n/a}}~~

	==See Also==		==See Also==
	{{SQL_functions}}		{{SQL_functions}}

Noon: /* Example */

2023-06-24T17:32:13Z

Example

← Older revision		Revision as of 17:32, 24 June 2023
Line 36:		Line 36:
	for idx,info in ipairs(playerInfos) do		for idx,info in ipairs(playerInfos) do
	if idx > 1 then		if idx > 1 then
	queryString = queryString . ","		queryString = queryString .. ","
	end		end
	queryString = queryString . dbPrepareString( connection, "(?,?,?)", info.name, info.serial, info.ispoopoohead )		queryString = queryString .. dbPrepareString( connection, "(?,?,?)", info.name, info.serial, info.ispoopoohead )
	end		end
	queryString = queryString . dbPrepareString( connection, " ON DUPLICATE KEY UPDATE name=VALUES(name),serial=VALUES(serial),ispoopoohead=VALUES(ispoopoohead) " )		queryString = queryString .. dbPrepareString( connection, " ON DUPLICATE KEY UPDATE name=VALUES(name),serial=VALUES(serial),ispoopoohead=VALUES(ispoopoohead) " )
	dbExec( connection, queryString );		dbExec( connection, queryString );

Myonlake at 22:38, 22 July 2018

2018-07-22T22:38:16Z

← Older revision		Revision as of 22:38, 22 July 2018
Line 1:		Line 1:
	__NOTOC__		__NOTOC__
	{{Server function}}		{{Server function}}
	{{New items\|3.~~0162~~\|1.5.2\|		{{New items\|3.0152\|1.5.2\|
	This function escapes arguments in the same way as [[dbQuery]], except dbPrepareString returns the query string instead of processing the query. This allows you to safely build complex query strings from component parts and help prevent (one class of) SQL injection.}}		This function escapes arguments in the same way as [[dbQuery]], except dbPrepareString returns the query string instead of processing the query. This allows you to safely build complex query strings from component parts and help prevent (one class of) SQL injection.}}

AlexTMjugador: "Serverside" section isn't needed, as this function is serverside only - it's obvious that it won't work on the client. This also conforms with the section usage in the majority of wiki pages

2016-01-26T17:00:16Z

"Serverside" section isn't needed, as this function is serverside only - it's obvious that it won't work on the client. This also conforms with the section usage in the majority of wiki pages

← Older revision		Revision as of 17:00, 26 January 2016
Line 21:		Line 21:

	==Example==		==Example==
	~~<section name="Serverside" class="server" show="true">~~
	This example shows how to safely build a dynamic SELECT query		This example shows how to safely build a dynamic SELECT query
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
Line 32:		Line 31:
	local handle = dbQuery( connection, queryString )		local handle = dbQuery( connection, queryString )
	</syntaxhighlight>		</syntaxhighlight>
	~~</section>~~
	~~<section name="Serverside" class="server" show="true">~~
	This example shows how to build an INSERT/UPDATE query for multiple rows. (Query syntax is MySQL only and assumes one column is a unique key)		This example shows how to build an INSERT/UPDATE query for multiple rows. (Query syntax is MySQL only and assumes one column is a unique key)
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
Line 47:		Line 44:

	</syntaxhighlight>		</syntaxhighlight>
	~~</section>~~

	==Requirements==		==Requirements==

Ccw at 09:52, 26 January 2016

2016-01-26T09:52:51Z

@@ Line 31: / Line 31: @@
 end
 local handle = dbQuery( connection, queryString )
 </syntaxhighlight>
 </section>

Ccw at 09:31, 26 January 2016

2016-01-26T09:31:19Z

← Older revision		Revision as of 09:31, 26 January 2016
Line 1:		Line 1:
	__NOTOC__		__NOTOC__
	{{Server function}}		{{Server function}}
	{{New items\|3.~~0152~~\|1.5.2\|		{{New items\|3.0162\|1.5.2\|
	This function ~~"prepares" an SQL~~ query string~~, returning a string that can be used in other SQL functions~~. This ~~is useful if~~ you ~~need~~ to ~~reuse queries multiple times, but also need arguments to be escaped. This is helpful in preventing~~ (one class of) SQL injection.		This function escapes arguments in the same way as [[dbQuery]], except dbPrepareString returns the query string instead of processing the query. This allows you to safely build complex query strings from component parts and help prevent (one class of) SQL injection.}}
	}}

	==Syntax==		==Syntax==
Line 22:		Line 21:

	==Example==		==Example==
	{{~~Example~~}}		<section name="Serverside" class="server" show="true">
			This example shows how to safely build a dynamic SELECT query
			<syntaxhighlight lang="lua">
			serialsToUse = { "111", "222", "333" }

			local queryString = dbPrepareString( connection, "SELECT * FROM `player_info` WHERE true" )
			for _,serial in ipairs(serialsToUse) do
			queryString = queryString .. dbPrepareString( connection, " AND `serial`=?", serial )
			end
			local handle = dbQuery( connection, queryString )
			</syntaxhighlight>
			</section>

			==Requirements==
			{{Requirements\|1.5.2\|n/a}}

	==See Also==		==See Also==
	{{SQL_functions}}		{{SQL_functions}}

Jusonex at 16:52, 14 January 2016

2016-01-14T16:52:02Z

← Older revision		Revision as of 16:52, 14 January 2016
Line 1:		Line 1:
	__NOTOC__		__NOTOC__
	{{Server function}}		{{Server function}}
	{{New items\|3.~~0160~~\|1.6\|		{{New items\|3.0152\|1.5.2\|
	This function "prepares" an SQL query string, returning a string that can be used in other SQL functions. This is useful if you need to reuse queries multiple times, but also need arguments to be escaped. This is helpful in preventing (one class of) SQL injection.		This function "prepares" an SQL query string, returning a string that can be used in other SQL functions. This is useful if you need to reuse queries multiple times, but also need arguments to be escaped. This is helpful in preventing (one class of) SQL injection.
	~~\|7745~~}}		}}

	==Syntax==		==Syntax==

Qaisjp: bump revision

2016-01-05T16:20:43Z

bump revision

← Older revision		Revision as of 16:20, 5 January 2016
Line 3:		Line 3:
	{{New items\|3.0160\|1.6\|		{{New items\|3.0160\|1.6\|
	This function "prepares" an SQL query string, returning a string that can be used in other SQL functions. This is useful if you need to reuse queries multiple times, but also need arguments to be escaped. This is helpful in preventing (one class of) SQL injection.		This function "prepares" an SQL query string, returning a string that can be used in other SQL functions. This is useful if you need to reuse queries multiple times, but also need arguments to be escaped. This is helpful in preventing (one class of) SQL injection.
	\|~~7743~~}}		\|7745}}

	==Syntax==		==Syntax==
Line 25:		Line 25:

	==See Also==		==See Also==
	{{~~Registry_functions~~}}		{{SQL_functions}}

Qaisjp: add version

2016-01-04T22:46:17Z

add version

← Older revision		Revision as of 22:46, 4 January 2016
Line 1:		Line 1:
	__NOTOC__		__NOTOC__
	{{Server function}}		{{Server function}}
			{{New items\|3.0160\|1.6\|
	This function "prepares" an SQL query string, returning a string that can be used in other SQL functions. This is useful if you need to reuse queries multiple times, but also need arguments to be escaped. This is helpful in preventing (one class of) SQL injection.		This function "prepares" an SQL query string, returning a string that can be used in other SQL functions. This is useful if you need to reuse queries multiple times, but also need arguments to be escaped. This is helpful in preventing (one class of) SQL injection.
			\|7743}}

	==Syntax==		==Syntax==

Qaisjp: add page

2016-01-04T22:45:50Z

add page

New page

__NOTOC__
{{Server function}}
This function "prepares" an SQL query string, returning a string that can be used in other SQL functions. This is useful if you need to reuse queries multiple times, but also need arguments to be escaped. This is helpful in preventing (one class of) SQL injection.

==Syntax==
<syntaxhighlight lang="lua">
string dbPrepareString ( element databaseConnection, string query [, var param1 [, var param2 ...]] )
</syntaxhighlight>
{{OOP||[[connection]]:prepareString}}
===Required Arguments===
*'''databaseConnection:''' A database connection element previously returned from [[dbConnect]]
*'''query:''' An SQL query. Positions where parameter values will be inserted are marked with a '''?'''

===Optional Arguments===
*'''paramX:''' A variable number of parameters. These must be strings or numbers - it is important to make sure they are of the correct type. Also, the number of parameters passed must be equal to the number of '''?''' characters in the query string.
String parameters are automatically quoted and escaped as required. (If you do not want a string quoted, use '''??''')

===Returns===
Returns a prepare SQL query string, or ''false'' if an error occurred.

==Example==
{{Example}}

==See Also==
{{Registry_functions}}