This function escapes arguments in the same way as dbQuery, except dbPrepareString returns the query string instead of processing the query. This allows you to safely build complex query strings from component parts and help prevent (one class of) SQL injection.

OOP Syntax Help! I don't understand this!

• Method:db-connection:prepareString(...)

Syntax

string|false dbPrepareString ( element db-connection, string query, var param1 [, var param2 ...] )

Required Arguments

• db-connection: A database connection element previously returned from dbConnect.
• query: An SQL query. Positions where parameter values will be inserted are marked with a ?.
• param1 [, var param2 ...]: A variable number of parameters. These must be strings or numbers - it is important to make sure they are of the correct type. Also, the number of parameters passed must be equal to the number of ? characters in the query string.

  String parameters are automatically quoted and escaped as required. (If you do not want a string quoted, use ??). Make sure that numbers are in number format as a string number is treated differently.

Returns

• string|false: query string

Returns a prepare SQL query string, or false if an error occurred.

Code Examples

Example 1 Example 2 (OOP) Example 3

server

This example shows how to safely build a dynamic SELECT query.

local serialsToUse = {"111", "222", "333"}

local queryString = dbPrepareString(connection, "SELECT * FROM `player_info` WHERE true")
for _, serial in ipairs(serialsToUse) do
    queryString = queryString ..dbPrepareString(connection, " AND `serial`=?", serial)
end

local handle = dbQuery(connection, queryString)

server

OOP Required

This example shows how to safely build a dynamic SELECT query.

local serialsToUse = {"111", "222", "333"}

local queryString = connection:prepareString("SELECT * FROM `player_info` WHERE true")
for _, serial in ipairs(serialsToUse) do
    queryString = queryString ..connection:prepareString(" AND `serial`=?", serial)
end

local handle = connection:query(queryString)

server

This example shows how to build an INSERT/UPDATE query for multiple rows. (Query syntax is MySQL only and assumes one column is a unique key).

local playerInfos = {} -- some table

local queryString = dbPrepareString(connection, "INSERT INTO `player_info` (name,serial,ispoopoohead) VALUES ")
for idx, info in ipairs(playerInfos) do
    if idx > 1 then
        queryString = queryString .. ","
    end
    queryString = queryString .. dbPrepareString(connection, "(?,?,?)", info.name, info.serial, info.ispoopoohead)
end
queryString = queryString .. dbPrepareString(connection, " ON DUPLICATE KEY UPDATE name=VALUES(name),serial=VALUES(serial),ispoopoohead=VALUES(ispoopoohead) ")
dbExec(connection, queryString);

See Also

Database Functions

• dbConnect
• dbExec
• dbFree
• dbPoll
• dbPrepareString
• dbQuery
• executeSQLQuery

Reference

• Scripting Functions