問題描述
我正在通過 Flex 在 AIR 中開發應用程序，但我沒有發現 SQLite 哪里出了問題(我已經習慣了 MySQL).參數有效，但僅在某些情況下有效.這部分是針對sql注入的內置衛生系統嗎?感謝您的幫助！
I'm developing an application in AIR via Flex, but I'm not seeing where I'm going wrong with SQLite (I'm used to MySQL). Parameters work, but only in certain instances. Is this part of the built-in sanitation system against sql injection? Thanks for any help!
作品:
sqlite
"INSERT :Fields FROM Category"，其中參數為:Fields = "*"
"INSERT :Fields FROM Category", where the parameter is :Fields = "*"
as3
var statement:SQLStatement = new SQLStatement();
statement.connection = connection;
statement.text = "INSERT :Fields FROM Category";
statement.parameters[":Fields"] = "*";
statement.execute;
不起作用(:Table"處的 SQL 語法錯誤):
sqlite
"INSERT :Fields FROM :Table"，其中參數為:Fields = "*" 和:Table = "Category"
"INSERT :Fields FROM :Table", where the parameters are :Fields = "*" and :Table = "Category"
as3
var statement:SQLStatement = new SQLStatement();
statement.connection = connection;
statement.text = "INSERT :Fields FROM :Table";
statement.parameters[":Fields"] = "*";
statement.parameters[":Table"] = "Category";
statement.execute;
推薦答案
通常不能將 SQL 參數/占位符用于數據庫標識符(表、列、視圖、架構等)或數據庫函數(例如，CURRENT_DATE)，但僅用于綁定文字 values.
Generally one cannot use SQL parameters/placeholders for database identifiers (tables, columns, views, schemas, etc.) or database functions (e.g., CURRENT_DATE), but instead only for binding literal values.
通過服務器端對參數化(又名準備好的)語句的支持，數據庫引擎會解析您的查詢一次，記住您將綁定的任何參數的特性——它們的類型、最大長度、精度等已解析查詢的后續執行.但是，如果關鍵位(如數據庫對象)未知，則無法將查詢正確解析為其句法元素.
With server-side support for parameterized (a.k.a. prepared) statements, the DB engine parses your query once, remembering out the peculiars of any parameters -- their types, max lengths, precisions, etc. -- that you will bind in subsequent executions of the already-parsed query. But the query cannot be properly parsed into its syntactic elements if critical bits, like database objects, are unknown.
因此，通常必須自己替換表名，在存儲過程或客戶端代碼中，動態連接/插值/任何要正確執行的 SQL 語句.在任何情況下，請記住使用您的 SQL API 函數來引用數據庫標識符，因為 API 不會為您做這件事.
So, one generally has to substitute table names oneself, in a stored procedure or in client code which dynamically concats/interpolates/whatevers the SQL statement to be properly executed. In any case, please remember to use your SQL API's function for quoting database identifiers, since the API won't do it for you.
這篇關于SQLite 參數 - 不允許表名作為參數的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網！