My Table::My Field becomes "My Table"."My Field"
It's not just field names that need to be escaped; If you're using literal values in your SQL, these need to be escaped correctly too. We're assuming here that these fields have their field type set corresponding to their name. e.g. 'My Timestamp' is a Timestamp field.
Supposing you are setting the following values in SQL:
My Table::My String = TodayMy Table::My Number = 1My Table::My Date = 28 Jan 2011My Table::My Time = 11pmMy Table::My Timestamp = 28 Jan 2011 11pm
This formatting applies wherever you are using these literal values - be that in an UPDATE statement, or in the WHERE part of the SQL Statement."My Table"."My String" = 'Today'"My Table"."My Number" = 1"My Table"."My Date" = DATE '2011-01-28'"My Table"."My Time" = TIME '23:00:00'"My Table"."My Timestamp" = TIMESTAMP '2011-01-28 23:00:00'
SELECT "My Table"."My Field" FROM "My Table" WHERE ( NULL, 0, 1, 2, 3, 'etc...' ) IN "My Table"."My ID"
UPDATE "My Table" SET "My Table"."My Field" = NULL
SELECT "My Table"."My Field" FROM "My Table" WHERE "My Table"."My Value" <> 'Exclude'
SELECT "My Table"."My Field" FROM "My Table" WHERE "My Table"."My Value" IS NULL
SELECT "My Table"."My Field" FROM "My Table" WHERE "My Table"."My Value" IS NOT NULL
SELECT "My Table"."My Field" FROM "My Table" WHERE "My Table"."My ID" = 'abc' ORDER BY "My Table"."My Sort" ASC
SELECT "My Table"."My Field" FROM "My Table" WHERE "My Table".rowid = 123
SELECT "My Table"."My Field" FROM "My Table" WHERE "My Table"."My Value" LIKE 'abc%'
// This won't work, as the SQL string is not quoted.
ReactorDoSQL( SELECT * FROM "My Table" WHERE "My Table"."My Status" = 'Active' )// This also won't work, as there are other double quotes in the middle of the statement.
ReactorDoSQL( "SELECT * FROM "My Table" WHERE "My Table"."My Status" = 'Active'" )// This works correctly, because the SQL statement is correctly quoted, and and escaped.
ReactorDoSQL( "SELECT * FROM \"My Table\" WHERE \"My Table\".\"My Status\" = 'Active'" )
Often, its much easier to define your SQL statement in a field earlier, as this reduces the need for you to do the heavy escaping as above. If our SQL statement from before was put into a field called Home::SQL, here's how we'd use the ReactorDoSQL function:
// No quoting needed, as we are passing through the fields contents, not the field name.
ReactorDoSQL( Home::SQL )
Comments