How to insert < ' > as a string in SQLite database in android ? [duplicate] - android

While I was trying the following SQL command , I got sql error.
INSERT INTO exampleTbl VALUES('he doesn't work for me')
where doesn't contain the apostrophe.
What is the way to insert text having ' (apostrophe) into a SQL table.

In SQL, the way to do this is to double the apostrophe:
'he doesn''t work for me'
However, if you are doing this programmatically, you should use an API that accepts parameters and escapes them for you automatically. Programmatically escaping and using string concatenation to assemble a query yourself is a sure way to end up with SQL injection vulnerabilities.

INSERT INTO exampleTbl VALUES('he doesn''t work for me')
If you're adding a record through ASP.NET, you can use the SqlParameter object to pass in values so you don't have to worry about the apostrophe's that users enter in.

$value = "he doesn't work for me";
$new_value = str_replace("'", "''", "$value"); // it looks like " ' " , " ' ' "
INSERT INTO exampleTbl (`column`) VALUES('$new_value')

try this
INSERT INTO exampleTbl VALUES('he doesn''t work for me')

insert into table1 values("sunil''s book",123,99382932938);
use double apostrophe inside of single apostrophe,
it will work

I know the question is aimed at the direct escaping of the apostrophe character but I assume that usually this is going to be triggered by some sort of program providing the input.
What I have done universally in the scripts and programs I have worked with is to substitute it with a ` character when processing the formatting of the text being input.
Now I know that in some cases, the backtick character may in fact be part of what you might be trying to save (such as on a forum like this) but if you're simply saving text input from users it's a possible solution.
Going into the SQL database
$newval=~s/\'/`/g;
Then, when coming back out for display, filtered again like this:
$showval=~s/`/\'/g;
This example was when PERL/CGI is being used but it can apply to PHP and other bases as well. I have found it works well because I think it helps prevent possible injection attempts, because all ' are removed prior to attempting an insertion of a record.

yes, sql server doesn't allow to insert single quote in table field due to the sql injection attack. so we must replace single appostrophe by double while saving.
(he doesn't work for me) must be => (he doesn''t work for me)

you can use backslash '\' if you want to display a single quote in your text.
INSERT INTO exampleTbl VALUES('He doesn(\')t') ;

Related

How to do a simple search in string in Firebase database?

I want to create a simple search in my app, but cannot find anything on interwebs about it, that's more recent than 2014. There must be a better way. There are startAt and endAt functions but they don't work as expected and are case sensitive. How do you guys solve this problem? How can this functionality still not exist in 2016?
In my case I was able to partly achieve a SQL LIKE in the following way:
databaseReference.orderByChild('_searchLastName')
.startAt(queryText)
.endAt(queryText+"\uf8ff")
The character \uf8ff used in the query is a very high code point in the Unicode range (it is a Private Usage Area [PUA] code). Because it is after most regular characters in Unicode, the query matches all values that start with queryText.
In this way, searching by "Fre" I could get the records having "Fred, Freddy, Frey" as value in _searchLastName property from the database.
Create two String variables
searchInputToLower = inputText.getText().toString().toLowerCase();
searchInputTOUpper = inputText.getText().toString().toUpperCase();
Then in the Query set it to:
DatabaseReference reference = FirebaseDatabase.getInstance().getReference().child("Products");//Your firebase node you want to search inside..
FirebaseRecyclerOptions<Products> options =
new FirebaseRecyclerOptions.Builder<Products>()//the Products is a class that get and set Strings from Firebase Database.
.setQuery(reference.orderByChild("name").startAt(searchInputUpper).endAt(searchInputLower + "\uf8ff"),Products.class)
.build();
the "name" it's the node inside the Products Main Node.
the .startAt(searchInputUpper) & .endAt(searchInputLower + "\uf8ff") to make the search as contains all characters that typed in the inputText.getText() that you get.
finally I got it you can use where clause to get you result like SQL
LIKE keyword like% or %like
syntax :
Firestore.collection(collectionName).orderBy(field).where(field, ">=", keyword.toUpperCase()).where(field, "<=", keyword.toUpperCase() + "\uf8ff").get()
I my case used:
var query = 'text'
databaseReference.orderByChild('search_name')
.startAt(`%${query}%`)
.endAt(query+"\uf8ff")
.once("value")
In this way, searching by "test" I could get the records having "Test 1, Contest, One test" as value in 'search' property from the database.
Firebase is noSQL therefore it does not have searches built in like you'll find in SQL. You can either sort by values/key or you can equalto
https://firebase.google.com/docs/database/android/retrieve-data
You can find examples at the link above. That is the latest documentation for firebase.
If you are looking for SQL like searches. Then take a look at elastic search. But that will increase the complexity since you need a platform to put it on. For that i could recommend Heroku or maybe GoogleCloudServers
Here is a blog post about advanced searches with elastic search
https://firebase.googleblog.com/2014/01/queries-part-2-advanced-searches-with.html
This question might be old but there is a documented way of how to achieve this way, It is simple to implement. Quoted:
To enable full text search of your Cloud Firestore data, use a third-party search service like Algolia. Consider a note-taking app where each note is a document:
Algolia will be part of your firebase functions and will do all the searches you want.
// Update the search index every time a blog post is written.
exports.onNoteCreated = functions.firestore.document('notes/{noteId}').onCreate(event => {
// Get the note document
const note = event.data.data();
// Add an 'objectID' field which Algolia requires
note.objectID = event.params.noteId;
// Write to the algolia index
const index = client.initIndex(ALGOLIA_INDEX_NAME);
return index.saveObject(note);
});
To implement the search, the best way is to use instant search - android
Sample Search Image: GIF
The feature you're looking for is called full-text search and this is something most databases (including Firebase) don't provide out-of-the-box because it requires storing the data in a format that's optimized for text search (vs optimized for filtering) - these are two different problem sets with a different set of trade-offs.
So you would have to use a separate full-text search engine in conjunction with Firebase to be able to do this, especially if you need features like faceting, typo tolerance, merchandizing, etc.
You have a few options for a full-text search engine:
There's Algolia which is easy to get up and running but can get expensive quickly
There's ElasticSearch which has a steep learning curve but uber flexible
There's Typesense which aims to be an open source alternative to Algolia.
I don't know about the certainty of this approach but using the firebase version 10.2.6 on android, i get to do something like this:
firebaseDatabase.getReference("parent")
.orderByChild("childNode")
.startAt("[a-zA-Z0-9]*")
.endAt(searchString)
It seems to work well sometimes
Finally joined SO just to answer this.
For anyone coming here from/for the python firestore.client here's a solution that seems to work for me.
It's based on the accepted answer's concept but via the client rather than db.reference() and mixed with the answer from user12750908.
from firebase_admin import firestore
users = db.collection("users")\
.order_by("last_name")\
.where("last_name", ">=", last_name.upper())\
.where("last_name", "<=", last_name.lower() + "\uf8ff")\
.stream()
It works for the simple test I did, but I'll update my answer if I have issues with it later. And just a reminder, this is similar to
LIKE search%
and not
LIKE %search%.
Edit 1
I didn't see any tags for the question, but the title attribute mentions Android so this may not necessarily answer the question directly, but if you have a python API, this should work. I'm unfortunately not sure if there's an equivalent client/db separation in the Android version like there is in the Firebase Admin for Python. I didn't want to delete the answer since I hadn't seen any answers for firestore client during my search for a similar answer and hope it helps anyone else stumbling around.
Edit 09-03-2020 This works a portion of the time it seems. Most of the time I didn't seem to have an issue, but when I applied it to another project I was getting unexpected results. Long story short you may need to replicate how you save the data you're comparing against. For example, you may need to have a field to save the last_name in all caps and another field to save it in all lowercase, then you change the first where clause to compare last_name_upper and the second to compare last_name_lowercase. In my second project so far this seems to yield more accurate results so you may want to give that a try if the previous answer doesn't work well
EDIT 09-07-2020 Previous edit from 09-03-2020 is partially accurate. During my haste of thinking I had it fully resolved I completely forgot firebase doesn't let you use <, >, <=, >= across different fields. You may need to do two queries and merge them, but you'd probably still be reading more docs than you really intend. Doing the comparison against either the upper or lower version with the appropriate search term seems to give the original results expected from the original answer. For example:
.orderBy("last_name_upper")
.where("last_name_upper", ">=", this.searchForm.text.toUpperCase())
.where("last_name_upper", "<=", this.searchForm.text.toUpperCase() + "\uf8ff")
As firebase documentation, firebase doesn't support full text search.
But to do that you can use third-party tools.
Check this link to learn more https://firebase.google.com/docs/firestore/solutions/search

How to update list of records with special characters into sqlite table using ormlite in Android

I am using ormlite for database operations in my Android app. I want to update around 1000 records at a time. But, if these records have any special characters such as ' / \ % , I am getting the following exception.
java.sql.SQLException: Problems executing Android statement: UPDATE `staticresource`
SET `Content` = 'Tick next to member and add by clicking on \'Invite Selected\'
button to create invite list.' ,`Id` = '3' WHERE `Alias` = 'tm'
So, how to update these records optimally. Thanks in advance.
You can escape special character's using
DatabaseUtils.sqlEscapeString();
String updateString = DatabaseUtils.sqlEscapeString("Tick next to member and add
by clicking on \'Invite Selected\' button to create invite list.");
updateString can be pass to ormlite update method.
How to update these records optimally.
The right thing to do is to use the UpdateBuilder combined with a SelectArg (which is a poor name). The SelectArg will use the ? SQL feature in which case your string can include special characters without issue.
UpdateBuilder ub = dao.updateBuilder();
updateBuilder.where().eq("Alias", "tm");
updateBuilder.updateColumnValue("Content",
new SelectArg("... on \'Invite Selected\' button to ..."));
updateBuilder.update();
This will generate something like:
UPDATE `staticresource` SET `Content` = ? WHERE `Alias` = 'tm'
And it will set the ? value to be your string. You don't need to worry about escaping anything. This is also how you protect user input from SQL injection attacks.

SQlite Language based table selection

just for curious, i got a question!
My app is almost ready.. I have implemented bilingual (English/Tamil) when users select thr preferred language in Settings then whole app gets converted into that language (i used custom Locale). Everything works fine.
My question is, Can we do the same to SQlite database? which fetch data automatically based on locale from table
"country-en"or"country-ta" ? is there any way? i heard that thr is a method SQLiteOpenHelper.onConfigure(setLocale()); to set locale in sqlitedatabase. i want to know how it works!
The method you describe above is not related to language localization for the client. It's related to locale options on the database (for example how to treat string comparisons with accented characters).
Anyway, if you think of it... what does localizing a database mean? You can either localize the structure or the data. Localizing the structure (table names...) doesn't make sens because the user is not aware of it. Localizing the data doesn't make sense either, because that means that if the users changes language settings, next time he uses your app he won't see his data!
If the DB only contains static data and you need to provide a different DB for different languages, you could use localization to lookup for the database filename.
Of course, yes, you can.
When you do your queries, just append "en" or "ta".
Something like "SELECT FROM Country_" + yourLocale + "..." - if you want to use two different tables.
OR you could use one single table with an integer field "Language" and you pass an int (0 = english, 1 = tamil - only for alphabetical order, which is easier to remind)...
Something like "... WHERE ... AND Language = 0"

Regular expression using sqlite in android

I having a difficulty with regex, I have a table products that of one of it`s field is a period.
I want to filter records by a period the user entered in my application.
for example the period might be 2006-2012 or just 2006-
I want to filter all the records that contain only the pattern 2006-
I tried many examples but unfortunately nothing works properly
this is my code
Cursor c = rDB.rawQuery("select title,price from Products,UserProducts where UserProducts.product_code=Prodcuts.product_code and USER_EMAIL=? and Products.period like '%[0-9]+%' group by UserSeries.product_code order by Products.title asc", new String[]{email});
while(c.moveToNext())
{
//save the records
}
Products.period like '%[0-9]+%'
LIKE does not work with regexps.
To use regular expression matching, use the REGEXP operator. Note that by default the REGEXP operator is not implemented, even though the syntax supports it.
For simpler matching needs you can also consider GLOB.
I want to filter all the records that contain only the pattern 2006-
You don't need a regular expression for that.
Products.period like '2006-%'
will match anything where period starts with the string 2006-.
I meant any year with "-" symbol at the end
Products.period like '%-'
will match anything where period ends with the string -.

Android - Make String SQL Safe

My CO-worker has created the below code for iOS to make a user defined string SQL search safe.
i.e to remove the possibility of SQL-injections and that kind of thing
char * sqlSafeQuery = sqlite3_mprintf("%q",[searchTerm UTF8String]);
searchTerm = [NSString stringWithFormat:#"%s", sqlSafeQuery];
sqlite3_free(sqlSafeQuery);
Is there a way in android to so something similar? I can't see much on the Google's :)
Thanks.
You may use prepared statements, see an Android question on how to use these in sqlite. As the statement is parsed without the user input in it, the parameters cannot change the statement itself; thus the injection cannot happen.

Categories

Resources