Parsing sql strings

Question

I have a method as below:

public boolean ReadingMade(int id, String readingdate)
{

    String selectQuery = "Select * From " + TABLE_METERREADING + " Where " +TENANTMETER_ID+ "="  +id + " And " + READINGDATE +"=" + readingdate;
    Log.e("LOG", selectQuery);      
    SQLiteDatabase db = this.getReadableDatabase();
    Cursor c = db.rawQuery(selectQuery, null);
    if(c.moveToFirst()){
        c.close();
    return true;
    }
    else
    {
        c.close();
        return false;
    }

}

I want to pass the string argument using a value from edit-text e.g

EditText readDate= (EditText)findViewById(R.id.editText1);
if (db.ReadingMade(id,readDate.getText().toString()) ==true)
        {

I get a string like one below

Select * From MeterReading Where TenantMeter_id=1 And ReadingDate=2014-01-20

Yet sq-lite expects

Select * From MeterReading Where TenantMeter_id=1 And ReadingDate='2014-01-20'

How do i pull it off?

Dear user, all the answers below are correct, you can mark any of these answers as accepted (ofcourse, if it helped you)...!!! — Chintan Soni
– Chintan Soni, Commented Feb 4, 2014 at 8:43

Apoorv · Accepted Answer · 2014-02-04 08:34:17Z

1

Just change

    String selectQuery = "Select * From " + TABLE_METERREADING + " Where " +TENANTMETER_ID+ "="  +id + " And " + READINGDATE +"=" + readingdate;

to

    String selectQuery = "Select * From " + TABLE_METERREADING + " Where " +TENANTMETER_ID+ "="  +id + " And " + READINGDATE +"= '" + readingdate+"'";

answered Feb 4, 2014 at 8:34

Apoorv

13.5k4 gold badges30 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Apoorv Over a year ago

Click on the tick mark that you can see beside my answer.

Blackbelt · Accepted Answer · 2014-02-04 08:34:20Z

1

If I have not misunderstood you, that should work

"='" + readingdate + "'"

answered Feb 4, 2014 at 8:34

Blackbelt

158k31 gold badges308 silver badges310 bronze badges

Comments

laalto · Accepted Answer · 2014-02-04 08:38:15Z

1

Use ? placeholders for literals to prevent the need to escape special characters in literals and to avoid SQL injection attacks:

String selectQuery = "Select * From " + TABLE_METERREADING + " Where " +TENANTMETER_ID+ "=? And " + READINGDATE +"=?";
// ...
String[] args = new String[] { Integer.toString(id), readingdate };
Cursor c = db.rawQuery(selectQuery, args);

(There's a performance benefit to ? args as well but it's normally not visible in the way Android SQLite API is used.)

answered Feb 4, 2014 at 8:38

laalto

153k68 gold badges293 silver badges306 bronze badges

2 Comments

user3109924 Over a year ago

This is the correct answer. Other answers leave you open to injection attacks and miss the utility of the ? parameter replacement feature in db.

user3079559 Over a year ago

Thank you. I am going to change.

Collectives™ on Stack Overflow

Parsing sql strings

3 Answers 3

1 Comment

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related