DbPrepareString

ADDED/UPDATED IN VERSION 1.5.2 :

This function escapes arguments in the same way as dbQuery, except dbPrepareString returns the query string instead of processing the query. This allows you to safely build complex query strings from component parts and help prevent (one class of) SQL injection.

Syntax

string dbPrepareString ( element databaseConnection, string query [, var param1 [, var param2 ...]] )

OOP Syntax Help! I don't understand this!

Method: connection:prepareString(...)

Required Arguments

• databaseConnection: A database connection element previously returned from dbConnect
• query: An SQL query. Positions where parameter values will be inserted are marked with a ?

Optional Arguments

• paramX: A variable number of parameters. These must be strings or numbers - it is important to make sure they are of the correct type. Also, the number of parameters passed must be equal to the number of ? characters in the query string.

String parameters are automatically quoted and escaped as required. (If you do not want a string quoted, use ??)

Returns

Returns a prepare SQL query string, or false if an error occurred.

Example

Click to collapse [-]

Serverside

This example shows how to safely build a dynamic SELECT query

serialsToUse = { "111", "222", "333" }

local queryString = dbPrepareString( connection, "SELECT * FROM `player_info` WHERE true" )
for _,serial in ipairs(serialsToUse) do
    queryString = queryString .. dbPrepareString( connection, " AND `serial`=?", serial )
end
local handle = dbQuery( connection, queryString )

Requirements

Minimum server version	1.5.2
Minimum client version	n/a

Note: Using this feature requires the resource to have the above minimum version declared in the meta.xml <min_mta_version> section. e.g. <min_mta_version server="1.5.2" />

See Also

• executeSQLQuery
• dbConnect
• dbExec
• dbFree
• dbPoll
• dbPrepareString
• dbQuery