Delphi: what is wrong with my SQL query not returning any results

Question

I was trying to prevent SQL injection in my Delphi application by securing user inputs using the following query:

procedure TForm1.Button1Click(Sender: TObject);
var userNameID : string;
begin
     userNameID := edit1.Text;
     with adoquery1 do
      begin
        sql.Clear;
        sql.Add('select * from users where id = :'''+userNameID+''';');
        Open;
      end;
end;

but it's not returning any results.

Can you tell me what's wrong in my code please?

It's much better to use parameters in your queries as opposed to strings. I think that the problem is the semicolon before the username. — No'am Newman
– No'am Newman, Commented Oct 6, 2018 at 4:37
SQL injection issues aside, the above code is probably not working because of the colon which should be removed — Steve
– Steve, Commented Oct 7, 2018 at 13:33

Ken White · Accepted Answer · 2018-10-06 04:39:08Z

5

Your code doesn't do anything to prevent SQL injection, because you're still directly concatenating text to the query. Your SQL syntax is also invalid.

Something like this will work:

procedure TForm1.Button1Click(Sender: TObject);
begin
  AdoQuery1.SQL.Text := 'select * from users where id = :ID');
  AdoQuery1.Parameters.ParamByName('ID').AsString := edit1.Text;
  AdoQuery1.Open;
end;

answered Oct 6, 2018 at 4:39

Ken White

126k15 gold badges237 silver badges476 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Jerry Dodge Over a year ago

@DJMixRhymez This is more than a "tip", this is the answer to your question. You should mark this as the accepted answer by clicking on the checkmark on the left.

DJ MixRhymez Over a year ago

sorry i'm new here, i still don't know how this website works, but thank you :)

Collectives™ on Stack Overflow

Delphi: what is wrong with my SQL query not returning any results

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related