How to use variables in a QSqlQuery?

Question

I want to implement a method that will check search for entries that have the localhost ip address upon exiting the program and delete those rows.

The problem is, I'm not sure how to do this in Qt I can't really find anything specific when I search. Is there a way to create a sql variable in qt, or can I use a qt variable in an sql query? To give you an idea of what I want to do please see below:

   QSqlQuery query;
   query.exec("DELETE FROM host WHERE ip = <localhost_variable??>");

Any tips?

I can't really find anything specific when I search Did you read the documentation of QSqlQuery? — scopchanov
– scopchanov, Commented Nov 5, 2020 at 9:50

scopchanov · Accepted Answer · 2020-11-05 09:45:15Z

2

Solution

You might of course inject the value directly in the query, as @NgocMinhNguyen suggested, but this is a not recommended, as it opens a security hole.

The recommended way to achieve this, is using query bindings.

Example

Here is a short example I have prepared for you to demonstrate how the proposed solution could be implemented in your case:

QSqlQuery query;

query.prepare("DELETE FROM host WHERE ip = :localhost");
query.bindValue(":localhost", localhost_variable);
query.exec();

answered Nov 5, 2020 at 9:45

scopchanov

8,44910 gold badges50 silver badges80 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Minh Over a year ago

Can you elaborate on what the security hole is and how query binding address that security hole?

scopchanov Over a year ago

@NgocMinhNguyen, From Wikipedia: Prepared statements are resilient against SQL injection because values which are transmitted later using a different protocol are not compiled like the statement template. If the statement template is not derived from external input, SQL injection cannot occur.

Minh · Accepted Answer · 2020-11-05 08:01:05Z

1

QSqlQuery::exec() takes a string as a parameter, so you can use:

QSqlQuery query;
query.exec(QString{"DELETE FROM host WHERE ip = %1"}.arg("some_localhost_ip"));

The final query will be:

DELETE FROM host WHERE ip = some_localhost_ip

answered Nov 5, 2020 at 8:01

Minh

1,7551 gold badge11 silver badges20 bronze badges

Collectives™ on Stack Overflow

How to use variables in a QSqlQuery?

2 Answers 2

Solution

Example

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Solution

Example

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related