Android SQLite INSERT

Question

I am using execSQL on SQLite database. The sql INSERT strnig is

INSERT INTO Tasks 
(_id, Aircraft, Station, Discrepancy,DateCreated, CreatedBy, Status, DateClosed, ClosedBy, ArrivalFlightID, RecordChangedByUI)  
 VALUES 
('271104','   ','ORD','Critical Flight (0496/28)','9/4/2011 6:57:00 PM','SYSTEM','NEW','','null','0','N')

Table is

"create table Tasks 
(_id integer primary key, "
+ "Aircraft text null, Station text null, Discrepancy text null, DateCreated text null, CreatedBy text null, Status text null, DateClosed text, ClosedBy text null, ArrivalFlightID text null, RecordChangedByUI text null);";

It's throwing an exception "Empty bindArgs"

Can anybody tell me where I am going wrong ?

String sql = "INSERT INTO Tasks (_id, Aircraft, Station, Discrepancy,DateCreated, CreatedBy, Status, DateClosed, ClosedBy, ArrivalFlightID, RecordChangedByUI) " VALUES ('" + tasks[i]._id + "','" + tasks[i].Aircraft + "','" + tasks[i].Station + "','" + tasks[i].Discrepancy + "','" + tasks[i].DateCreated + "','" + tasks[i].CreatedBy + "','" + tasks[i].Status + "','" + tasks[i].DateClosed + "','" + tasks[i].ClosedBy + "','" + tasks[i].ArrivalFlightID + "','N')"; this.database.execSQL(sql, null); — user533844
– user533844, Commented Sep 7, 2011 at 15:44

Sebastian Nowak · Accepted Answer · 2012-07-11 09:11:08Z

11

You can not pass null as second parameter. If you're not using it, just ignore it and it will work:

String sql = "INSERT INTO Tasks (_id, Aircraft, Station, Discrepancy,DateCreated, CreatedBy, Status, DateClosed, ClosedBy, ArrivalFlightID, RecordChangedByUI) " VALUES ('" + tasks[i]._id + "','" + tasks[i].Aircraft + "','" + tasks[i].Station + "','" + tasks[i].Discrepancy + "','" + tasks[i].DateCreated + "','" + tasks[i].CreatedBy + "','" + tasks[i].Status + "','" + tasks[i].DateClosed + "','" + tasks[i].ClosedBy + "','" + tasks[i].ArrivalFlightID + "','N')"; 
this.database.execSQL(sql);

However, the above example is vulnerable - SQL query can be easily injected. All strings passed to the query should be escaped via DatabaseUtils.sqlEscapeString(task[i].something).

edited Jul 11, 2012 at 9:11

answered Sep 7, 2011 at 16:00

Sebastian Nowak

5,7179 gold badges71 silver badges111 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Massimo Fazzolari Over a year ago

What if task[i].Station contains a single quote?

Sebastian Nowak Over a year ago

All strings should be escaped via DatabaseUtils.sqlEscapeString(task[i].something). I've just copied the SQL query from author's comment. I'll add it to the answer.

Massimo Fazzolari · Accepted Answer · 2012-07-11 16:09:31Z

8

Try executing database.insert or insertOrThrow. It requires the explicit adding of each field to a ContentValues object, but it is so much neater.

ContentValues insertValues = new ContentValues();
insertValues.put("_id", tasks[i]._id);
... // other fields
long rowId = this.database.insert(DATABASE_TABLE, null, insertValues);

edited Jul 11, 2012 at 16:09

Massimo Fazzolari

5,2323 gold badges29 silver badges37 bronze badges

answered Sep 7, 2011 at 16:02

adamcodes

1,60613 silver badges21 bronze badges

Collectives™ on Stack Overflow

Android SQLite INSERT

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related