views:

116

answers:

3

Project CompetitionServer.exe raised exception class ESQLiteException with message 'Error executing SQL.
Error [1]: SQL error or missing database.
"INSERT INTO MatchesTable(MatchesID,RoundID,AkaFirstName,AoFirstName)VALUES(1,2,p,o)": no such column: p'. Process stopped. Use Step or Run to continue.

Yes, p is NOT a column, it is the data I am trying to insert. How can I fix this problem?

+2  A: 

You value 'p' is a constant, so you need to put it in quotes. So the statement needs to be

INSERT INTO MatchesTable(MatchesID,RoundID,AkaFirstName,AoFirstName)VALUES(1,2,'p','o')
Rob McDonell
+3  A: 

In SQL, string constants that are data must be enclosed in quotes. Otherwise the string is interpreted as a keyword, table name, or column name, which is what's happening here. Use 'p' instead of plain p.

Larry Lustig
And 'o' instead of plain o.
mghie
SQLite doesnt force a column you declare to be Integer to actual hold only integer values, I somehow took that to mean that I could input string data without quotes as if it could be an integer which was obviously flawwed. Thanks.
NeoNMD
+2  A: 

You have to use SQL parameters. The standard Delphi approach to that:

Query1.SQL.Text := 'INSERT INTO MatchesTable(MatchesID,RoundID,AkaFirstName,AoFirstName)VALUES(1,2,:p,:o)';
Query1.Params[0].Value := ...;
Query1.Params[1].Value := ...;
Query1.ExecSQL;

But details may depend on the data access components you are using.

da-soft
OP doesn't *have* to use parameters, but it surely is a better idea than building the SQL statement by concatenating SQL snippets and data entered by the user - that way lie injection attacks. I will assume his statement *is* built at runtime.
mghie
Injection is only one issue. Few others - values formating and performance. So, although NeoNMD does not have to use parameters, but it is a good practice, which must be a DB programmer rule.
da-soft
I am using a delphi SQLite wrapper which I do not believe has the functionality you sat above.All SQL is ran as string statements using something along these lines:TSqlDatabase.ExecSQL(SQL:String);So it just directly tries to run strings you pass it.Also there is no risk of injection as all the data is generated by the system. At no point does it take user inputs.This is however my first attempt at actually using a database in a program and so will look into that for any further projects.
NeoNMD