sql中的错误Where子句等于来自arguments函数的变量

Question

我想弹出一个带有2个链接表的列表视图，为此我创建了下一个sql：

public static Cursor ListViewTimeStudy(String passedReg) {
            // TODO Auto-generated method stub

            String sql = "SELECT "
                    + "elements._id,"
                    + "elements.idstudy,"
                    + "elements.code_element,"
                    + "times._id,"
                    + "times.idelement,"                    
                    + "times.observedtime,"
                    + "times.observedactivity"
                    + " FROM "
                    + "elements JOIN times"
                    + " ON "
                    + "elements._id = times.idelement"
                    + " WHERE "
                    + "elements.idstudy = passedReg"
                    + " ORDER BY "
                    + "times._id DESC";



            Cursor mCursor = ourDatabase.rawQuery(sql, null);

            if (mCursor != null) {
                mCursor.moveToFirst();
            }
            return mCursor;
        }

结果应该显示一个表，其中包含两个表中的字段，以及只有elements.idstudy等于函数参数中传递的变量的行，但在本期中我收到错误。

Answer 1

Java和SQL是两种不同的语言;他们不会自动看到彼此的变量。

要将字符串值传递给SQL查询，请使用参数：

String sql = "SELECT ..."
        + " WHERE idstudy = ?"
        + "...";
cursor = db.rawQuery(sql, new String[] { passedReg });