Exception while running Sqlite query!

Question

This is the error i get:

 **ERROR/Database(13775): Failure 1 (near "s": syntax error)**

while i try to execute the following query:

myDB.execSQL("INSERT INTO " + tableName + " (" + column[1] + "," + column[2] + "," + column[3] + "," + column[4] + ","
                                + column[5] + "," + column[6] + "," + column[7] + "," + column[8] + ",type ) VALUES('" + url + "','" + title + "','" + summary + "','" + imageUrl + "','" + completeStoryUrl + "','" + date + "','" + imageString + "','" + body + "','" + type + "')");

These values are being stored in Db by parsing an xml having RSS feeds like objects. few items are stored but on some i get this exception. Is there a problem of query of the data being sent to tha query..??? Any help is appreciated.

You might need to escape the INSERT values - [this thread might help][1] [1]: stackoverflow.com/questions/5432063/… — Michalis
– Michalis, Commented Jul 19, 2011 at 10:48

schlamar · Accepted Answer · 2011-07-19 10:44:06Z

1

You should never create a SQL command with string manipulation because there is the danger of a SQL injection. There are methods to safely format the command with parameter.

In Java there is for example the java.sql.PreparedStatement class.

Using such a conventional method should fix your syntax error, too.

answered Jul 19, 2011 at 10:44

schlamar

9,5593 gold badges43 silver badges77 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

chedine Over a year ago

Its on android. Java.sql.preparedstatement doesn't apply. Morever, this should be in the comment section..This is not an answer.

schlamar Over a year ago

I cannot comment because of my rep. There are ways for a prepared statement on android, too (see stackoverflow.com/questions/433392/…). This was only an example. This is a really important note and should not be voted down!

chedine Over a year ago

My bad. I didn't notice your rep.. Otherwise i wouldn't have downvoted.

JeffG · Accepted Answer · 2011-07-19 11:23:54Z

0

Without seeing the actual query that is being executed, I would guess that one of the fields being inserted contains a " character, which is breaking the SQL statement.

for example imagine if the value of summary was

This string need"s to be escaped

As Michalis said, you need to escape the values being inserted ( replace any special characters )

If I were you, I would log the actual string query that is being executed. Then take a look in logcat at it and you should see why it is failing.

answered Jul 19, 2011 at 11:23

JeffG

3,3421 gold badge29 silver badges34 bronze badges

Collectives™ on Stack Overflow

Exception while running Sqlite query!

2 Answers 2

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related