How to view stored data from GUI

Databases
1

Hi All

i am in need of assistance
i created a Desktop app where i can save the data from the textfields in to a database (SQLite) but i am finding difficulty viewing the saved data. it saves but i dont know where exactly
i cant seem to find the saved data on SQLite

Thanks

2

Please show us the code you are using for saving data to SQLite DB

3

Please do see the below code i used to save to the database(SQLite)

Var sql As String

Try
sql = “INSERT INTO StoreDetails (ID, OwnersName, OwnersSurname, OwnersEmail, OwnersPhone, OwnersAddress1, OwnersAddress2, OwnersAddress3, OwnersCityStateRegion, OwnersPostalCode, SiteName, SitePhone, SiteEmail, SiteAddress1, SiteAddress2, SiteAddress3, SiteCityStateRegion, SitePostalCode) VALUES ('”+txtOwnersName.Text+“', '”+txtOwnersSurname.Text+“', '”+txtOwnersEmail.Text+“', '”+txtOwnersPhone.Text+“', '”+txtOwnersAddress1.Text+“', '”+txtOwnersAddress2.Text+“', '”+txtOwnersAddress3.Text+“', '”+txtOwnersCityStateRegion.Text+“', '”+txtOwnersPostalCode.Text+“', '”+txtSiteName.Text+“', '”+txtSitePhone.Text+“', '”+txtSiteEmail.Text+“', '”+txtSiteAddress1.Text+“', '”+txtSiteAddress2.Text+“', '”+txtSiteAddress3.Text+“', '”+txtSiteCityStateRegion.Text+“', '”+txtSitePostalCode.Text+“');”

MessageBox(“Successful”)
Catch e As DatabaseException
ErrorLabel.Text = e.Message
End Try

it works but i cant find where exaclty it is saved
i doesnt show on my DB on my PC either

thanks

4

Based on your sample code, all you have done is defined a string with a SQL command inside it. There is no code executing the SQL command.

also. I recommend that you do not concatenate the data into the SQL statement and instead, use parameter binding.

1 Like
5

ok well as @kevin_g has pointed out there is no code for executing the SQL

You might want to go over this documentation: https://documentation.xojo.com/topics/databases/supported_engines/sqlite/sqlitedatabase_for_beginners.html

If you still need help please revisit and ask away :grin:

1 Like
6

A couple of things. When sharing code it is good to highlight the code and press the </> button on the toolbar. This will format the code nicely and make it far more readable.

The second thing, From a security point of view it is very very dangerous to write SQL code in by concatenating strings together like this. By cleverly entering bad data into your application the application could be used to do things like “erase your entire database”, “share any data that is contained in the database with the hacker”. You need to look at SQL Injection. It is very real and happens frequently.

One of the best ways of preventing this is to use prepared statements. They also make your live easier because you don’t have to worry things such as quoting strings and adjusting for stange characters in you source data (such as " and ’ ).

The simple guide. Instead of:

sql = “INSERT INTO StoreDetails (ID, OwnersName, OwnersSurname, OwnersEmail, OwnersPhone, OwnersAddress1, OwnersAddress2, OwnersAddress3, OwnersCityStateRegion, OwnersPostalCode, SiteName, SitePhone, SiteEmail, SiteAddress1, SiteAddress2, SiteAddress3, SiteCityStateRegion, SitePostalCode) VALUES ('”+txtOwnersName.Text+“', '”+txtOwnersSurname.Text+“', '”+txtOwnersEmail.Text+“', '”+txtOwnersPhone.Text+“', '”+txtOwnersAddress1.Text+“', '”+txtOwnersAddress2.Text+“', '”+txtOwnersAddress3.Text+“', '”+txtOwnersCityStateRegion.Text+“', '”+txtOwnersPostalCode.Text+“', '”+txtSiteName.Text+“', '”+txtSitePhone.Text+“', '”+txtSiteEmail.Text+“', '”+txtSiteAddress1.Text+“', '”+txtSiteAddress2.Text+“', '”+txtSiteAddress3.Text+“', '”+txtSiteCityStateRegion.Text+“', '”+txtSitePostalCode.Text+“');”

you do the following:

sql = “INSERT INTO StoreDetails (ID, OwnersName, OwnersSurname, OwnersEmail, OwnersPhone, OwnersAddress1, OwnersAddress2, OwnersAddress3, OwnersCityStateRegion, OwnersPostalCode, SiteName, SitePhone, SiteEmail, SiteAddress1, SiteAddress2, SiteAddress3, SiteCityStateRegion, SitePostalCode) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);”

That’s a ? for each parameter. You then call ExecuteSQL and pass in the values you wish to include.

db.ExecuteSQL( sql, txtOwnersName.Text, txtOwnersSurname.Text, txtOwnersEmail.Text, txtOwnersPhone.Text, txtOwnersAddress1.Text, txtOwnersAddress2.Text, txtOwnersAddress3.Text, txtOwnersCityStateRegion.Text, txtOwnersPostalCode.Text, txtSiteName.Text, txtSitePhone.Text, txtSiteEmail.Text, txtSiteAddress1.Text, txtSiteAddress2.Text, txtSiteAddress3.Text, txtSiteCityStateRegion.Text, txtSitePostalCode.Text )

If is so much safer.

2 Likes
7

You do not show the part of the code that creates a FolderItem (OS Reference) to Write / Read Data in/out…

If none, you save data in memory and this is a different beast.

1 Like
8

The OP has not yet acknowledged that he understands that creating some SQL is not enough and he needs to run that SQL.

1 Like