Sql statement JavaScript

Question

I see the statement in executeSql like below:

addTodo: function (text) {
        app.db.transaction(function (tx) {
            var ts = new Date();
            tx.executeSql("INSERT INTO todo(todo, added_on) VALUES (?,?)", [text, ts], app.onSuccess, app.onError);
        });
    },

My question is: what does the " VALUES (?,?) " mean?

mb21 · Accepted Answer · 2014-10-05 09:47:11Z

1

That's a prepared statement, which you should use to prevent SQL Injection attacks. E.g.

var text = "foo";
var ts = "bar";
tx.executeSql("INSERT INTO todo(todo, added_on) VALUES (?,?)", [text, ts]);

is the same as:

tx.executeSql("INSERT INTO todo(todo, added_on) VALUES ('foo','bar')");

answered Oct 5, 2014 at 9:47

mb21

40.3k8 gold badges130 silver badges158 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Barry · Accepted Answer · 2014-10-05 10:01:54Z

1

Those are parameters that will be properly prepared and substituted by the array argument following the SQL statement.

So

tx.executeSql("INSERT INTO todo(todo, added_on) VALUES (?,?)", ['do this', '10/05/2014']);

will result in

INSERT INTO todo(todo, added_on) VALUES ('do this', '10/05/2014')

edited Oct 5, 2014 at 10:01

answered Oct 5, 2014 at 9:45

Barry

3,7331 gold badge20 silver badges25 bronze badges

Collectives™ on Stack Overflow

Sql statement JavaScript

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related