how to build sql queries using c

Question

I was wondering if it is possible to build a string with the following code

char query[512];
char *insert = "insert into tableName values("%s, "%s");"
strcpy(query, insert);
method("max", "1234"); //function which adds values inro %s

My questions, how can I add another char array into in place of %s if it is possible? Thanks beforehand.

Thanks for your effort I will try that as well sprintf is also working ))) — Max
– Max, Commented Dec 17, 2018 at 3:38

jobinrjohnson · Accepted Answer · 2020-05-29 02:14:20Z

2

use sprintf() so that you can replace the %s with char array https://linux.die.net/man/3/sprintf

char query[512];
char *insert = "insert into tableName values(\'%s\',\'%s\');";
sprintf(query, insert, "max","234");
printf("%s",query);

This is actually a bad approach. This will introduce SQL Injection vulnerabilities.

edited May 29, 2020 at 2:14

answered Dec 17, 2018 at 3:34

jobinrjohnson

5585 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Max Over a year ago

Thank you very very much @jobinrjohnson sprintf that solved my problem)))

David C. Rankin Over a year ago

Nit - insert should be const char * (see prototype in linked man page) and there is no need to escape single-quotes within double-quotes, e.g. const char *insert = "insert into tableName values('%s','%s');"; is sufficient.

Max Over a year ago

Thanks))) it helped a lot ))

Collectives™ on Stack Overflow

how to build sql queries using c

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related