How to make a string safe for a Webkit Javascript Database

Question

I am writing a Webkit app that imports data from an RSS feed and stores it in a Javascript Database. Since the data is coming from an external source I want to make sure the strings have been made safe before inserting it into the database. For example in PHP I would use "mysql_real_escape_string" function which escapes quotes and other characters.

Ideally I want to keep away from native functions so that this app can be deployed across multiple phone platforms (iPhone,Blackberry,Android) using WebKit.

Link to equivalent PHP function: http://php.net/manual/en/function.mysql-real-escape-string.php

Link to javascript database documentation: https://developer.apple.com/library/archive/documentation/iPhone/Conceptual/SafariJSDatabaseGuide/UsingtheJavascriptDatabase/UsingtheJavascriptDatabase.html

Example code:

Currently it is:

mydb.transaction(
    function(transaction) {
        transaction.executeSql("INSERT INTO rss (url,title) VALUES (?,?);",["www.some-rss-feed.com","a title containing a' quote"], successFunction, errorFunction);
    }
);

Ideally it should be something like the following where "a_safe_function" is the name of the function that makes the string safe for the database.

mydb.transaction(
    function(transaction) {
        transaction.executeSql("INSERT INTO rss (url,title) VALUES (?,?);",[a_safe_function("www.some-rss-feed.com"),a_safe_function("a title containing a' quote")], successFunction, errorFunction);
    }
);

Libraries I'm using:

iPhoneGap
JQueryMobile
JQuery

ThiefMaster · Accepted Answer · 2011-03-27 09:48:37Z

1

You don't have to do any escaping when passing query and arguments separately.

Merging query and parameters is an ugly thing which is done mainly for PHP+MySQL as PHP had no proper way to pass query and parameters separately before PDO - and even nowadays many people are not using PDO but rather escaping their values (or forgetting it ;x) and building SQL strings synamically :/

answered Mar 27, 2011 at 9:48

ThiefMaster

320k85 gold badges608 silver badges648 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

woot586 Over a year ago

Thanks! that explains why i'm having difficulty finding an escape function.

Collectives™ on Stack Overflow

How to make a string safe for a Webkit Javascript Database

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related