ansaurus

Question

Answer 1

+1 A:

At the very least, you should be using parameterized queries.

For example:

sqlite3_reset(insertStatement);

sqlite3_bind_text(insertStatement, 1, [userInput UTF8String], -1, SQLITE_TRANSIENT);

if(SQLITE_DONE != sqlite3_step(insertStatement))
{
    //handle error

//etc...

You could also use Core Data and rely on it to handle the implementation details. That'd be my recommendation.

Don 2010-06-29 04:38:48

Hi Don,This is what I am doing. I'm just worried about people trying to drop my tables or delete the database when entering their name.Or does this get around that?

Dwaine Bailey 2010-06-29 04:47:50

Yes, SQL injection attacks assume you are building the query string in memory. Parameterized queries using, say, string data will only allow string data and will treat the input as a string. That is, if they try to get you to execute `SELECT * FROM users WHERE name = 'a';DROP TABLE users;` it will be sent to the database as `SELECT * FROM users WHERE name = "'a';DROP TABLE users;"`.

Don 2010-06-29 05:19:07

ansaurus

tags:

views:

answers:

SQLITE and iPhone Input Sanitisation

related questions