Question

我试图用参数替换一些字符串插入。所以我有这个执行查询的代码：

cursor.execute("DELETE FROM tablename WHERE COL=?" , ("column"))

我可以用

替换它

'use strict';

var React = require('react-native');
var ProgressBar = require('react-native-progress-bar');

var {
  AppRegistry,
  AsyncStorage,
  StyleSheet,
  Text,
  View,
  TouchableHighlight
} = React;

var PROGRESS = 0;

var styles = StyleSheet.create({
  container: {
    flex: 1,
    justifyContent: 'center',
    alignItems: 'center',
    backgroundColor: '#FFF',
  },
  button: {
    alignSelf: 'center',
    marginTop: 50,
    width: 100,
    height: 50,
    backgroundColor: '#0059FF',
    borderRadius: 8,
    borderWidth: 2,
    borderColor: '#0059FF'
  },
  buttonClear: {
    alignSelf: 'center',
    marginTop: 10,
    width: 100,
    height: 50,
    backgroundColor: '#3B3A3A',
    borderRadius: 8,
    borderWidth: 2,
    borderColor: '#3B3A3A'
  },
  buttonText: {
    fontSize: 18,
    textAlign: 'center',
    lineHeight: 33,
    color: '#FFF',
  }
});

class BasicStorageExample extends React.Component {
  constructor(props) {
    super(props);

    this.state = {
      progress: PROGRESS
    };
  }

  onButtonPress() {
    this.setState({
      progress: PROGRESS += 0.2
    });
  }

  onButtonClearPress() {
    PROGRESS = 0;
    this.setState({
      progress: 0
    });
  }

  render() {
    return (
      <View style={styles.container}>
        <ProgressBar
          fillStyle={{}}
          backgroundStyle={{backgroundColor: '#cccccc', borderRadius: 2}}
          style={{marginTop: 10, width: 300}}
          progress={this.state.progress} />
        <TouchableHighlight
          style={styles.button}
          underlayColor='#002C7F'
          onPress={this.onButtonPress.bind(this)}>
          <Text style={styles.buttonText}>Done</Text>
        </TouchableHighlight>
        <TouchableHighlight
          style={styles.buttonClear}
          underlayColor='#002C7F'
          onPress={this.onButtonClearPress.bind(this)}>
          <Text style={styles.buttonText}>Clear</Text>
        </TouchableHighlight>
      </View>
    );
  }
};

AppRegistry.registerComponent('BasicStorageExample', () =>     BasicStorageExample);

但我希望我的tablename在变量中。如何保护表的变量插入sql注入？

Answer 1

如果您的目标是确保变量是有效表的名称，则可以使用

获取表名列表

SELECT name FROM sqlite_master WHERE type='table'

然后检查使用配置文件中的变量是否与其中一个表匹配。这避免了必须对表列表进行硬编码。

SQLite表名参数

1 个答案: