Sql statement JavaScript -
Sql statement JavaScript -
i see statement in executesql below:
addtodo: function (text) { app.db.transaction(function (tx) { var ts = new date(); tx.executesql("insert todo(todo, added_on) values (?,?)", [text, ts], app.onsuccess, app.onerror); }); },
my question is: " values (?,?) " mean?
that's prepared statement, should utilize prevent sql injection attacks. e.g.
var text = "foo"; var ts = "bar"; tx.executesql("insert todo(todo, added_on) values (?,?)", [text, ts]);
is same as:
tx.executesql("insert todo(todo, added_on) values ('foo','bar')");
javascript sql sqlite
Comments
Post a Comment