参见英文答案 >
cant use like clause in android app 6
我想使用预备的语句来防止在SQL SQL数据库上的sql注入.但是,当查询包含Like并且与Where name =?一起工作时,rawquery会崩溃?
有没有办法在Android SQLite数据库中使用类似和准备好的语句?
这是查询:
sqlQuery = "SELECT * FROM " + TABLE_CALLS + " where " + CALLER_NAME + " like ? COLLATE NOCASE or " + CALLER_NBR + " like ? or " + CALLER_EXT + " like ?" + " or " + IS_OUTGOING + " like ? COLLATE NOCASE or " + TYPE + " like ? COLLATE NOCASE";
Cursor cursor = database.rawQuery(sqlQuery, new String[]{"%" + criterion + "%", "%" + criterion + "%","%" + criterion + "%","%" + criterion + "%","%" + criterion + "%"});
它会使绑定或列索引超出范围
谢谢.