C++ / Sqlite questions
(1.1) Originally by apffal with edits by drh on 2024-07-29 10:23:36 from 1.0 [link] [source]
First question
I've created a Visual Studio C++ application for retrieving results from a Sqlite database.
As, on getting those results, I was receiving wrong accented characters, I sucessfully changed that part of my code like this:
dest = static_cast<const wchar_t*>(sqlite3_column_text16(stmt, 1));
But now, if I update a record, from the C++ application, containing accented characters:
querySQL = "UPDATE rank SET dest_ = '"+dest+"' ... WHERE n_ord = "+ord+""; sqlite3_exec(dbase, querySQL, NULL, NULL, &err);
Sqlite creates a blob and returns again wrong characters at concerning field.
How can I convert records containing those characters and send to database in order to get them acceptable by Sqlite ?
Second question
Trying to execute multiple statements in one Sqlite query, separated by ";", it only executes the first and second (create a table and insert records from another), ignoring the last two (drop a table and renaming another)
How to solve this ?
Thanks in advance
(2) By stephan on 2024-07-29 10:29:55 in reply to 1.1 [link] [source]
How to solve this ?
Your chances of getting an actionable response will skyrocket if you'll show exactly what you did, rather than describe it in general terms and show only snippets which nobody else can compile.
(3) By slavin on 2024-07-29 12:20:51 in reply to 1.1 [source]
First question:
Ignoring SQLite, how are you telling VSC++ what type of characters are in your string ?
Second question:
Which SQLite3 function are you calling ? Are you checking the result to see whether an error has been returned ?
(4) By anonymous on 2024-07-29 13:18:07 in reply to 1.1 [link] [source]
Try using a prepared statement and binding your UTF-16 text as such using sqlite3_bind_text16
.
Note that sqlite3_exec
accepts UTF-8-encoded SQL, so however you're concatenating your SQL query, it must account for potential differences in the encoding.
(5) By drh on 2024-07-29 13:27:29 in reply to 1.1 [link] [source]
querySQL = "UPDATE rank SET dest_ = '"+dest+"' ... WHERE n_ord = "+ord+"";
This is called an SQL Injection. It is the #1 cause of vulnerabilities in applications. You should never construct SQL text from variables (like "dest" and "ord") which can possibly be controlled or influenced by an attacker. Never. Just don't do that.
Use the parameter binding interfaces of SQLite, or as a last resort, use the sqlite3_mprintf() interface of SQLite or similar with the "%Q" substitution letter in the format string for inserting string content.