Greetings!
I am using SQLite. I want to declare variable, but it gives me a syntax error. Please help me to find a solution:
Select * from t2 where value= ? This is my query. Now how can I pass values to ? ?
Thanks in advance, Jennie
- 4Query is correct. Which programming language / library are you using to send the query?Vincent Mimoun-Prat– Vincent Mimoun-Prat2011-04-11 09:20:30 +00:00Commented Apr 11, 2011 at 9:20
- Hi Jennie. As stated by MarvinLabs, you should spend some time reading the (FAQ)[stackoverflow.com/faq], revisit your previous questions and accept some satisfying answers (use the check mark button next to the question of your choice to accept it).MPelletier– MPelletier2011-04-11 14:39:28 +00:00Commented Apr 11, 2011 at 14:39
Add a comment |
3 Answers
As far as I know SQLite doesn't support anything like that.
The syntax is standard for libraries that implement bound parameters (and prepared statements that use them), but you would need to do that in a programming language that queries the database, and not in the database itself.
The specifics, of course, depend on the programming language and the library.
In Perl, for example you could:
my $sth = $dbh->prepare("Select * from t2 where value=?"); foreach my $value (@values) { $sth->execute($value); $row = $sth->fetchrow_hashref; [...] } Bobby Tables has some more examples in a variety of languages.
1 Comment
Donal Fellows
SQLite is always bound to a host language (though it's the trivial language in the case of the
sqlite shell). Moreover, ? is just the syntax for positional bound parameters; SQLite also supports named bound parameters via :someName.You can support variables in sqlite using an in-memory temp table. See my answer at https://stackoverflow.com/a/14574227/1435110
Comments
The only way to use variables like that is by using the binding functions. In many cases, constructing a query string in the language you are using is easier.
2 Comments
Quentin
Easier, but more prone to SQL injection vulnerabilities.
MPelletier
@Quentin Well, yes. You'd better sanitize if you don't bind, unless you're willing to take the chance someone inputs "0; drop all tables" as their search value, if it's even likely in that context.