SQLite Prepared Statements

Paul_Lefebvre · April 5, 2014, 9:05pm

Use something like this:

LIKE ?

in the SQL.

Then bind it to text that has the values concatenated:

BindValue(2, "%" + value + "%")

Peter_Fargo · April 6, 2014, 11:33am

Paul’s method has always worked for me.

Sam_Rowlands · April 7, 2014, 2:53am

As an old fart… who’s never used bind, always created an explicit string or used the replace function, what’s the advantage of using bind?

Tim_Hare · April 7, 2014, 3:50am

Safety. Prepared statements are the only safe way to protect yourself from injection attacks.