preferred way to update sqlite db in android

Question

Which way to use db.update is faster and better in android? ie: construct the entire where clause string along with where clause variable values OR make use of the 4th parameter for update by passing where clause variable values as a string array?

Does passing where clause variable values as a new string array protect against sql injection attacks?

  public boolean UpdateChannelSortKey(Channel c)
  {
        ContentValues cv = new ContentValues();
        cv.put("SortKey", c.SortKey);
        return this.db.update("Channels", cv, "ChannelID = ?", new String[]{String.valueOf(c.ChannelID)}) > 0;
  }

OR

public boolean UpdateChannelSortKey(Channel c)
  {
        ContentValues cv = new ContentValues();
        cv.put("SortKey", c.SortKey);
        return this.db.update("Channels", cv, "ChannelID = " + c.ChannelID, null) > 0;
  }

Vladimir Ivanov · Accepted Answer · 2011-03-01 12:35:40Z

8

The first way is preferable, because:

1) Yes, it protects against sql-injection attacks.

2) It is better to always use the prepared statements - not in android only, so you will obtain a good habit.

3) IMHO, it has higher readability.

answered Mar 1, 2011 at 12:35

Vladimir Ivanov

43.2k19 gold badges80 silver badges103 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

preferred way to update sqlite db in android

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related