SQL: update table using create statement -


I am using the following to update the fields in my SQL table:

 < Code> Private string update data (handle, string user name, string name, string table) {handle.createStatement ("sql / Create.sql") .bind ("playername", name) .bind ("tablename", table). Execute (); }  

The create.sql file is as follows:

  update: tablename SET varname =: name name: name =: username {/ code> < / Pre> 

I know that this is not working because: tablename is a string variable i will type code for sql to identify the name of the table as i actually do it as hard code Typed?

You can not name table as a parameter - only data can be passed to you To change and change the table name "paste" in SQL itself. Very Important Note: You have to make sure that the value of the table variable does not come from any type of user input. Otherwise, you are opening your code in SQL injection attacks.

  string sql = string.form ("UPDATE% s SET varname =: name of name: name =: username" table); Handle.createStatement (sql) .bind ("playername", name). Execute ();  

If the value of the table comes from user input, the code changed to use different hardcodes or preconfigured wires defined in their program Please.


Comments

Popular posts from this blog

java - org.apache.http.ProtocolException: Target host is not specified -

java - Gradle dependencies: compile project by relative path -

ruby on rails - Object doesn't support #inspect when used with .include -