Insert into SQLite with variables using javascript

Question

I am developing an extension for Firefox and I have created SQLite DB. When inserting values into the table I get an error message:

Error: Permission denied for http://en.wikipedia.org to call method UnnamedClass.toString on <>.

The string values to be inserted are stored in a variable.

var book = "Harry Potter";
var myInsertQuery = 'INSERT INTO mybooks_tbl(title) VALUES('+ book + ');';

How do we insert data into the table as variables and not as strings?

That error message is quite unlikely to have anything to do with your problem.. Care to post more of the code? — Nickolay
– Nickolay, Commented Oct 18, 2009 at 12:46

bobince · Accepted Answer · 2009-10-18 11:53:55Z

2

SQLite follows the ANSI standard for string literals:

A string constant is formed by enclosing the string in single quotes ('). A single quote within the string can be encoded by putting two single quotes in a row

so:

function sqlstr(s) {
    return "'"+s.replace(/'/g, "''")+"'";
}

var query= 'INSERT INTO books(title) VALUES('+sqlstr(book)+');';

You must remember to escape all string literals like this, or you will have made a client-side SQL-injection hole.

answered Oct 18, 2009 at 11:53

bobince

538k111 gold badges675 silver badges846 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

sdwilsh Over a year ago

Really, you shouldn't do the escaping yourself, however. You should use the binding functions that are available and let the engine handle it for you: developer.mozilla.org/En/Storage#Binding_Parameters

fftoolbar Over a year ago

Thanks and i found a way around it by binding the parameter.

FundamentalsJ · Accepted Answer · 2013-07-20 09:36:47Z

1

There is error in the string only var query= 'INSERT INTO books(title) VALUES('+sqlstr(book)+');';

tx.executeSql('INSERT INTO CLASS_LIST ("class_title","") VALUES("+v.classTitle+")');

answered Jul 20, 2013 at 9:36

FundamentalsJ

111 bronze badge

Comments

Algorys · Accepted Answer · 2020-01-27 11:13:24Z

0

For sqlite3:

After some research, I found a simple way to not worry about assembling the string of a query. You've just to add parameters with colon ahead.

let myObj = {
    paramOne: "First value",
    paramTwo: "Second value",
};
let sqlQuery = 'INSERT INTO myTable VALUES(:paramOne, :paramTwo);';

# Run command and variable will be replaces
db.run(sqlQuery, [myObj.paramOne, myObj.paramTwo], ...)

answered Jan 27, 2020 at 11:13

Algorys

1,7903 gold badges26 silver badges57 bronze badges

Collectives™ on Stack Overflow

Insert into SQLite with variables using javascript

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related