[Gambas-user] How to write sql query in gambas way

[Benoît Minisini]

Le 10/05/2022 à 14:16, Gianluigi a écrit :
>     Yes so it seems to work fine :-)
> 
>     Public Sub Button2_Click()
> 
>        Dim res As Result
> 
>        res = conn.Exec("select fldtitle from tbltest where flddepartment
>     in (" & "'" & xCountry.Join("','") & "'" & ");")
> 
>        If res.Available Then
>          ListBox1.List = res.All("fldtitle")
>        Endif
> 
>     End
> 
>     Regards
>     Gianluigi
> 
> 
> I exaggerated with the '&' but that's the concept :-D
> 
> res = conn.Exec("select fldtitle from tbltest where flddepartment in ('" 
> & xCountry.Join("','") & "');")
> 
> Regards
> Gianluigi
> 
> 
> ----[ http://gambaswiki.org/wiki/doc/netiquette ]----

But if you omit to use Connection.Subst(), your code is utterly wrong, 
as it introduces a possible SQL injection.

Regards,

-- 
Benoît Minisini