Insert into SQLite with variables using javascript

Question

Hi,

I am developing an extension for firefox and i have created a SQLite DB. When inserting values into the table i get an error message: Error: Permission denied for http://en.wikipedia.org to call method UnnamedClass.toString on <>. The string values to be inserted are stored in a variable.

var book = "Harry Potter";
var myInsertQuery = 'INSERT INTO mybooks_tbl(title) VALUES('+ book + ');';

how do we insert data into the table as variables and not as strings?

cheers

Answer 1

SQLite follows the ANSI standard for string literals:

A string constant is formed by enclosing the string in single quotes ('). A single quote within the string can be encoded by putting two single quotes in a row

so:

function sqlstr(s) {
    return "'"+s.replace(/'/g, "''")+"'";
}

var query= 'INSERT INTO books(title) VALUES('+sqlstr(book)+');';

You must remember to escape all string literals like this, or you will have made a client-side SQL-injection hole.