c++ Bind wide string to sqlite3 prepared statement

Question

I am trying to bind wide string to sqlite3 prepared statement. I was trying to follow this answer, but it didn't work

    const auto sql_command = L"SELECT * FROM register_names WHERE name is ?VVV";
    sqlite3_stmt *statement;
    sqlite3_prepare16(db, sql_command, -1, &statement, NULL);
    wstring p = ObjectAttributes->ObjectName->Buffer;
    sqlite3_bind_text16(statement, 1,  p.data(), -1, SQLITE_TRANSIENT);
    printf("sql command: %s\n", sqlite3_sql(statement));
    auto data = "Callback function called";
    char *zErrMsg = nullptr;

    auto rc = sqlite3_exec(db,  sqlite3_sql(statement), callback, (void *) data, &zErrMsg);

I tried using 0 or 1 in sqlite3_bind_text16 but I either get null or original string with no substitution. What am I doing wrong?

Remy Lebeau · Accepted Answer · 2022-03-18 23:13:53Z

2

In your SQL statement, change is to =, and change ?VVV to just ?.

More importantly, per the documentation, sqlite3_exec() is not the correct way to execute a sqlite3_stmt you have prepared. You need to use sqlite3_step() (and sqlite3_finalize()) instead.

Try this:

const auto sql_command = u"SELECT * FROM register_names WHERE name = ?";

sqlite3_stmt *statement;
auto rc = sqlite3_prepare16(db, sql_command, -1, &statement, NULL);
if (rc != SQLITE_OK) ...

rc = sqlite3_bind_text16(statement, 1, ObjectAttributes->ObjectName->Buffer, ObjectAttributes->ObjectName->Length, SQLITE_TRANSIENT);
if (rc != SQLITE_OK) ...

printf("sql command: %s\n", sqlite3_sql(statement));

while ((rc = sqlite3_step(statement)) == SQLITE_ROW)
{
    // process row as needed using sqlite3_column_XXX() functions...
}

if (rc != SQLITE_DONE) ...

rc = sqlite3_finalize(statement);
if (rc != SQLITE_OK) ...

edited Mar 18, 2022 at 23:13

answered Mar 18, 2022 at 23:07

Remy Lebeau

609k36 gold badges516 silver badges875 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

ntdllnewbie.dll Over a year ago

would prepared statement be enough to prevent sql injection? or in c++ prepared statements are different?

Remy Lebeau Over a year ago

@ntdllnewbie.dll "would prepared statement be enough to prevent sql injection?" - yes. That is one of the benefits of using prepared statements. Another is performance.

Collectives™ on Stack Overflow

c++ Bind wide string to sqlite3 prepared statement

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related