Changing the table name in SQLite in objective-c

Question

So I'm currently compiling a simple SQL query like this:

    const char *sqlQuery = "SELECT value FROM settings WHERE name=? LIMIT 1";

    sqlite3_stmt *compiledStatement;

    if(sqlite3_prepare_v2(database, sqlQuery, -1, &compiledStatement, nil) == SQLITE_OK)
    {
        sqlite3_bind_text(compiledStatement, 1, [name UTF8String], -1, SQLITE_TRANSIENT);

        while(sqlite3_step(compiledStatement) == SQLITE_ROW)
        {
            NSString *theValue = [NSString stringWithUTF8String:(char *)sqlite3_column_text(compiledStatement, 0)];

            // ...
        }
    }

However I would like to be able to change the table name I'm calling. I thought I could change the sqlQuery to:

const char *sqlQuery = "SELECT value FROM ? WHERE name=? LIMIT 1";

And then bind it before I bind the name value, however this doesn't work. I guess this is designed to only work for selection args...

Does anyone know if there is a way to insert the table name here or do I just have to do it in plain text?

lakshmen · Accepted Answer · 2013-04-08 14:01:08Z

1

NSString *queryString = [NSString stringWithFormat:@"SELECT value FROM %@ WHERE name=%@ LIMIT 1",tablename,attribute];

 const char *sqlQuery = [queryString UTF8String];

Hope this helps..

answered Apr 8, 2013 at 14:01

lakshmen

29.2k68 gold badges183 silver badges286 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

ingh.am Over a year ago

Why didn't that answer happen in my brain ;) Thanks for the help!

Martin R Over a year ago

If the "name" parameter comes from user input, then you should still use sqlite3_bind_text for "name = ?", to avoid the danger of SQL injection (xkcd.com/327)

ingh.am Over a year ago

In my case the "name" parameter is a #define I have stored in the header file, but you make a valid point for anyone reading this who does use it for something based on user input.

sixthcent · Accepted Answer · 2013-04-08 14:10:45Z

1

 NSString *sqlTemplate = @"SELECT value FROM %@ WHERE name=? LIMIT 1";

 //assuming you have your table name stored in tableName variable
const char *sqlQuery = [[NSString stringWithFormat:sqlTemplate, tableName] UTF8String];

sqlite3_stmt *compiledStatement;

if(sqlite3_prepare_v2(database, sqlQuery, -1, &compiledStatement, nil) == SQLITE_OK)
{
    sqlite3_bind_text(compiledStatement, 1, [name UTF8String], -1, SQLITE_TRANSIENT);

    while(sqlite3_step(compiledStatement) == SQLITE_ROW)
    {
        NSString *theValue = [NSString stringWithUTF8String:(char *)sqlite3_column_text(compiledStatement, 0)];

        // ...
    }
}

answered Apr 8, 2013 at 14:10

sixthcent

1,1607 silver badges6 bronze badges

Collectives™ on Stack Overflow

Changing the table name in SQLite in objective-c

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related