iphone - 我怎样才能将加密数据插入sqlite。我在插入加密数据时遇到错误

Question

如何将加密数据插入sqlite。我在插入加密数据时遇到错误。 bcos 加密了如此多的单引号和双引号，因此在创建我的 sql 时，字符串正在损坏。有没有其他方法可以插入数据而不丢失数据。我也担心使用添加斜杠方法 bsoc 它可能会改变我的实际加密数据。任何人都可以给我一个建议..另请在下面找到我的插入查询功能

-(BOOL) insertItemData:(NSString *)encryptedData folderId:(NSString *)folderId
{
   bool giveBackValue = 0;

   database = [[[DBConnection alloc] init] autorelease];

  if(sqlite3_open([[database filePath] UTF8String], &db) == SQLITE_OK)
  {
    NSString *sql = [[[NSString alloc] initWithFormat:@"INSERT INTO tbl_content (FolderId, Content) VALUES ('%@', '%@');", folderId, encryptedData] autorelease];
    NSLog(@"%@",sql);
    char *sqlError;
    if(sqlite3_exec(db, [sql UTF8String], nil, nil, &sqlError) == SQLITE_OK)
    {
        giveBackValue = 1;
    }
    else
    {
        //Query exec failed

    }
}
else
{
    //DB Open failed
}

return giveBackValue;
}

我的选择查询功能

-(void)getFirstJsonListInFolder:(NSString *)folderId listCarrier:(NSMutableArray **)listCarrier
{
    database = [[[DBConnection alloc] init] autorelease];
    NSMutableArray *dummyListCarrier = [[[NSMutableArray alloc] init] autorelease];

    if (sqlite3_open([[database filePath] UTF8String], &db) ==SQLITE_OK)
    {
        NSString *sql = [[NSString alloc] initWithFormat:@"SELECT Content from tbl_content WHERE FolderId = '%@'", folderId];

    sqlite3_stmt *result;
    if(sqlite3_prepare_v2(db, [sql UTF8String], -1, &result, nil) == SQLITE_OK)
    {
        while (sqlite3_step(result) == SQLITE_ROW)
        {
            char *contentList = (char *)sqlite3_column_text(result, 0);
            NSString *contentListString = [[NSString alloc] initWithUTF8String:contentList];
            [dummyListCarrier addObject:contentListString];
            [contentListString release];
        }
    }
    else 
    {
        //Query exec failed
    }
}
else
{
    //DB Open failed
}
*listCarrier = dummyListCarrier;
}

Answer 1

您应该避免直接为sql语句中的列赋值。相反，您应该使用准备好的语句并将值绑定(bind)到它。

NSString *sql = @"INSERT INTO tbl_content (FolderId, Content) VALUES ('?', '?');";
char *sql = (char *) [sql UTF8String];
sqlite3_bind_text(stmt, 1, [Content UTF8String], -1, SQLITE_TRANSIENT);

*这不是完整的代码