xcode FMDB 问题并在“executeQuery:”中插入值来自 searchString
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/6710417/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Problem with FMDB and insert value in the "executeQuery:" from a searchString
提问by Steven David
While building a Search for my app i ran into a problem whilst using the FMDB SQLite Wrapper (https://github.com/ccgus/fmdb).
在为我的应用程序构建搜索时，我在使用 FMDB SQLite Wrapper (https://github.com/ccgus/fmdb) 时遇到了问题。
When I search my database with this SQL Command, everything is fine. 13 objects are returned and I can use them.
当我用这个 SQL 命令搜索我的数据库时，一切都很好。返回了 13 个对象，我可以使用它们。
FMResultSet *rs = [db executeQuery:@"SELECT * FROM ZARTICLE WHERE ZTITLEDE LIKE '%Daimler%'"];
But when i try to insert the searchQuery from the User Input like this:
但是当我尝试像这样从用户输入插入 searchQuery 时：
FMResultSet *rs = [db executeQuery:@"SELECT * FROM ZARTICLE WHERE ZTITLEDE LIKE (?)", theSearchQuery];
... the value is dont be inserted into SQL Command. And I dont get any returned objects from the DB. even if the String (theSearchQuery) is the same written in the first example.
...该值不会被插入到 SQL 命令中。而且我没有从数据库中得到任何返回的对象。即使字符串 (theSearchQuery) 与第一个示例中编写的相同。
Additionaly I post a part from the documentation of FMDB for your convinience. :)
另外，为了您的方便，我从 FMDB 的文档中发布了一部分。:)
Data Sanitization
When providing a SQL statement to FMDB, you should not attempt to "sanitize" any values before insertion. Instead, you should use the standard SQLite binding syntax:
向 FMDB 提供 SQL 语句时，不应尝试在插入前“清理”任何值。相反，您应该使用标准的 SQLite 绑定语法：
INSERT INTO myTable VALUES (?, ?, ?) The ? character is recognized by SQLite as a placeholder for a value to be inserted. The execution methods all accept a variable number of arguments (or a representation of those arguments, such as an NSArray or a va_list), which are properly escaped for you.
INSERT INTO myTable VALUES (?, ?, ?) ? SQLite 将字符识别为要插入的值的占位符。执行方法都接受可变数量的参数（或这些参数的表示形式，例如 NSArray 或 va_list），这些参数已为您正确转义。
Thus, you SHOULD NOT do this (or anything like this):
因此，您不应该这样做（或类似的事情）：
[db executeUpdate:[NSString stringWithFormat:@"INSERT INTO myTable VALUES (%@)", @"this has \" lots of ' bizarre \" quotes '"]]; Instead, you SHOULD do:
[db executeUpdate:[NSString stringWithFormat:@"INSERT INTO myTable VALUES (%@)", @"this has \"很多'奇怪的\"引号'"]]; 相反，你应该：
[db executeUpdate:@"INSERT INTO myTable VALUES (?)", @"this has \" lots of ' bizarre \" quotes '"]; All arguments provided to the -executeUpdate: method (or any of the variants that accept a va_list as a parameter) must be objects. The following will not work (and will result in a crash):
[db executeUpdate:@"INSERT INTO myTable VALUES (?)", @"this has \"很多'奇怪的\"引号'"]; 提供给 -executeUpdate: 方法（或任何接受 va_list 作为参数的变体）的所有参数都必须是对象。以下将不起作用（并会导致崩溃）：
[db executeUpdate:@"INSERT INTO myTable VALUES (?)", 42]; The proper way to insert a number is to box it in an NSNumber object:
[db executeUpdate:@"INSERT INTO myTable VALUES (?)", 42]; 插入数字的正确方法是将其装箱到 NSNumber 对象中：
[db executeUpdate:@"INSERT INTO myTable VALUES (?)", [NSNumber numberWithInt:42]]; Alternatively, you can use the -execute*WithFormat: variant to use NSString-style substitution:
[db executeUpdate:@"INSERT INTO myTable VALUES (?)", [NSNumber numberWithInt:42]]; 或者，您可以使用 -execute*WithFormat: 变体来使用 NSString 样式的替换：
[db executeUpdateWithFormat:@"INSERT INTO myTable VALUES (%d)", 42]; Internally, the -execute*WithFormat: methods are properly boxing things for you. The following percent modifiers are recognized: %@, %c, %s, %d, %D, %i, %u, %U, %hi, %hu, %qi, %qu, %f, %g, %ld, %lu, %lld, and %llu. Using a modifier other than those will have unpredictable results. If, for some reason, you need the % character to appear in your SQL statement, you should use %%.
[db executeUpdateWithFormat:@"INSERT INTO myTable VALUES (%d)", 42]; 在内部， -execute*WithFormat: 方法为您正确装箱。识别以下百分比修饰符：%@、%c、%s、%d、%D、%i、%u、%U、%hi、%hu、%qi、%qu、%f、%g、% ld、%lu、%lld 和 %llu。使用除这些之外的修饰符将产生不可预测的结果。如果出于某种原因，您需要 % 字符出现在您的 SQL 语句中，您应该使用 %%。
回答by elise
NSString *search_text = [NSString stringWithFormat:@"%%%@%%", theSearchQuery];
FMResultSet *rs = [db executeQuery:@"SELECT * FROM ZARTICLE WHERE ZTITLEDE LIKE ?", search_text];
回答by Sebastian Hojas
I would highly recommend to avoid creating queries with stringWithFormat:! There is a good reason why FMDB tries to force you to use their data sanitization. However, since FMDB is boxing your input, surrounding parenthesis in the following code are not needed and may cause your problem.
我强烈建议避免使用 stringWithFormat 创建查询：！FMDB 试图强迫您使用他们的数据清理是有充分理由的。但是，由于 FMDB 将您的输入装箱，因此不需要以下代码中的括号，这可能会导致您的问题。
[db executeQuery:@"SELECT * FROM ZARTICLE WHERE ZTITLEDE LIKE (?)", theSearchQuery];
Simple add arguments without any parenthisis because you never know how FMDB boxes your argument internally.
简单地添加没有任何括号的参数，因为您永远不知道 FMDB 如何在内部装箱您的参数。
[db executeQuery:@"SELECT * FROM ZARTICLE WHERE ZTITLEDE LIKE ?", theSearchQuery];
If this still doesn't work try to use the suggested executeQueryWithFormat: method of FMDB:
如果这仍然不起作用，请尝试使用建议的 executeQueryWithFormat: FMDB 方法：
[db executeQueryWithFormat:@"SELECT * FROM ZARTICLE WHERE ZTITLEDE LIKE %@", theSearchQuery];
