Search code examples
javascriptnode.jsdatabasestringnode-sqlite3

what characters are not allowed in sqlite3 string without adding additional stuff

For example:
I want to insert a value which is a string
but the string contains a single quote (hello'world)
what I meant when I say 'adding additional stuff'
is you have to add two quotes (hello''world)
so it becomes valid
I want to know all character like that or all character that doesn't need 'additional stuff'

Solution

  • This overriding of native SQL queries can be prevented by using prepared statements. Use the prepare() method.

    Example from the sqlite3 package readme modified to your use case:

    var stmt = db.prepare("INSERT INTO lorem VALUES (?)");
stmt.run('hello"world');
stmt.run("hello'world");
stmt.finalize();

    Safely inserts both hello"world and hello'world values.