android - 获取数据 -sqlite 和 android

Question

当我写

                     Cursor c = customersDB.rawQuery("SELECT Name, Street, Block, City  FROM "    +
                            TABLE_NAME +
                            " where Name == 'VOLKSWAGEN '", null);

它的工作goog。

但：

String x="ll";



                     Cursor c = customersDB.rawQuery("SELECT Name, Street, Block, City  FROM "    +
                            TABLE_NAME +
                            " where Name == "+x, null);

犯错误。

Answer 1

您需要将变量用单引号括起来并以分号结尾。我的建议是使用 string.format 所以你的查询字符串看起来像

String.format("SELECT Name, Street, Block, City FROM %1$s WHERE Name == '%2$s';", TABLE_NAME, x)

另一种方法是"SELECT Name, Street, Block, City FROM " + TABLE_NAME + "where Name == '" + x + "';", null);

Answer 2

如果可能，您应该始终使用参数：

String x="ll";
Cursor c = customersDB.rawQuery(
              "SELECT Name, Street, Block, City FROM " + TABLE_NAME +
              " WHERE Name == ?",
              new String[]{ x });

这避免了格式化问题和SQL 注入攻击。