iOS sqlite insert statments with variables - ios

Question

I am learning how to use sqlite in IOS
I am using the following to insert a record into a table
int DBID = [_db ExecuteINSERT:#"INSERT INTO LOG(NAME , COMPANY , CATEGORY) VALUES('txt1','txt2','txt3')"];
This works fine and adds the three strings into a row
I want to exchange the hardcoded strings for string variable but can work out what to do. I tried
NSString* myString1 = #"String1";
NSString* myString2 = #"String2";
NSString* myString3 = #"String3";
int DBID = _db ExecuteINSERT:#"INSERT INTO LOG(NAME , COMPANY, CATEGORY) VALUES(myString1, myString2, myString3)"];
But I get a sqlite error 1 no such column but there is as it works with hardcoded strings
any ideas where I'm going wrong?
Any help appreciated
Mark

Answer 1

You are declaring the same string 3 times, but I will assume that this is just a typo in your question, and what you really have (or at least meant) is:
NSString* string1 = #"String1";
NSString* string2 = #"String2";
NSString* string3 = #"String3";
Your next problem is that you have included the variable names as literal strings inside the " - This means that the SQL statement will contain "string1" not the value of string1 which is what you are after.
Since you are using a wrapper around SQLite, you can use stringWithFormat to create the insert statement with the values of the string variables substituted
NSString *sqlStatement=[NSString stringWithFormat:#"INSERT INTO LOG(NAME, COMPANY,CATEGORY) values (\"%#\",\"%#\",\"%#\")",string1,string2,string3];
int DBID = [_db ExecuteINSERT:sqlStatement];
It is worth noting that this is unsafe since you cannot guard against SQL injection where the values are obtained from user input. This may not be a concern on a mobile device; the worst a user can do is affect their own database.
The technically correct approach if you weren't using a wrapper is to use sqlite3_prepare_v2 -
sqlite3_stmt *statement;
NSString *insertSQL = #"INSERT INTO LOG(NAME, COMPANY,CATEGORY) values (?,?,?)";
const char *insert_stmt = [insertSQL UTF8String];
if (sqlite3_prepare_v2(_db, insert_stmt,-1, &statement, NULL)!= SQLITE_OK) {
// LOG THE ERROR
NSLog(#"Error: failed to perpare statement with message '%s'.", sqlite3_errmsg(_db));
}
else {
// Bind values to the statement
sqlite3_bind_text(statement,1,[string1 UTF8String],-1,SQLITE_TRANSIENT);
sqlite3_bind_text(statement,2,[string2 UTF8String],-1,SQLITE_TRANSIENT);
sqlite3_bind_text(statement,3,[string3 UTF8String],-1,SQLITE_TRANSIENT);
double retValue = sqlite3_step(statement);
if (retValue == SQLITE_DONE) {
NSLog(#"Insert successful");
}
sqlite3_reset(statement);
sqlite3_finalize(statement);
}
This second block of code creates a statement with three placeholders (?,?,?) and then substitutes strings into those placeholders with sqlite3_bind_text. Finally, the statement is executed with sqlite3_step.
The last couple of lines just clean up.