lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]

* Vasanta:

> Thanks a lot for your help. I am using sqlite3.

Here's a complete example.  It turns out that LuaSQL doesn't support
parametrized queries (or prepared statements), so you have to do your
escaping manually.

It's key to encode all externally supplied data with conn:escape(str)
and wrap its result in ''.

require "luasql.sqlite3"

local env = luasql.sqlite3()
local conn = env:connect(":memory:")
assert(conn:execute("CREATE TABLE foo(a, b)"))
local data = [['"]]
assert(conn:execute("INSERT INTO foo VALUES ('"
		    .. conn:escape(data)
		 .. "', 'data')"))
local c = conn:execute("SELECT a, b FROM foo")
while true do
   local a, b = c:fetch()
   if a then
      print(a, b)