# SQLite SELECT using a variable as a condition

**URL:** <https://forum.xojo.com/t/sqlite-select-using-a-variable-as-a-condition/47265>\
**Category:** Databases\
**Created:** [February 7, 2019, 8:27am UTC](https://forum.xojo.com/t/sqlite-select-using-a-variable-as-a-condition/47265 "2019-02-07T08:27:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mike\_Wyatt](https://forum.xojo.com/letter_avatar_proxy/v4/letter/m/3be4f8/32.png) [@Mike\_Wyatt](https://forum.xojo.com/u/Mike_Wyatt)\
**Post date:** [February 7, 2019, 8:27am UTC](https://forum.xojo.com/t/sqlite-select-using-a-variable-as-a-condition/47265/1 "2019-02-07T08:27:31Z")

</div>

This is such a simple problem that I feel almost embarrassed to ask. I am trying to retrieve selected records from an SQLite Database using a condition. Suppose I have an integer field where I want to retrieve records whose value is great (or less) than a certain number, if I use the syntax “… SELECT FROM tablename WHERE fieldname \> 10”, it works fine. Likewise, if I use the the value of the content of a text field - "…SELECT FROM tablename WHERE fieldname \> " + txtxyz.Text, it also works OK. But if I convert the value to an integer variable, I just can’t get the syntax right. I suspect it’s something quite simple, but can some kindly soul out there please help !!

Mike

---

<div class="post-metadata">

**Author:** ![Jean-Yves\_Pochez](https://forum.xojo.com/user_avatar/forum.xojo.com/jean-yves_pochez/32/21769_2.png) [@Jean-Yves\_Pochez](https://forum.xojo.com/u/Jean-Yves_Pochez)\
**Post date:** [February 7, 2019, 8:29am UTC](https://forum.xojo.com/t/sqlite-select-using-a-variable-as-a-condition/47265/2 "2019-02-07T08:29:03Z")

</div>

you must convert your integer variable to a string using Str(my\_integer\_variable)

---

<div class="post-metadata">

**Author:** ![David\_Cox](https://forum.xojo.com/user_avatar/forum.xojo.com/david_cox/32/227_2.png) [@David\_Cox](https://forum.xojo.com/u/David_Cox)\
**Post date:** [February 7, 2019, 9:56am UTC](https://forum.xojo.com/t/sqlite-select-using-a-variable-as-a-condition/47265/3 "2019-02-07T09:56:50Z")

</div>

ie "SELECT FROM tablename WHERE fieldname \> " + Str(my\_integer\_variable)

but if my\_integer\_variable is extremely large (in the billions) the STR() command may turn it into something like ‘1.23e10’, so I favour something like this as being more future-proof:

```auto
"SELECT FROM tablename WHERE fieldname > " + FORMAT("#############0", my_integer_variable)
```

---

<div class="post-metadata">

**Author:** ![Marius\_Dieter\_Noetzel](https://forum.xojo.com/user_avatar/forum.xojo.com/marius_dieter_noetzel/32/661_2.png) [@Marius\_Dieter\_Noetzel](https://forum.xojo.com/u/Marius_Dieter_Noetzel)\
**Post date:** [February 7, 2019, 12:52pm UTC](https://forum.xojo.com/t/sqlite-select-using-a-variable-as-a-condition/47265/4 "2019-02-07T12:52:08Z")

</div>

You should never ever use variables in queries without escaping. Even if there is not that big sql-injection-problem with integer…  
You should really use a prepared statement.

Dim ps As SQLitePreparedStatement = db.Prepare(“SELECT FROM tablename WHERE fieldname \> ?”)

ps.BindType(0, SQLitePreparedStatement.SQLITE\_INTEGER)  
ps.Bind(0, txtxyz)  
dim rs as RecordSet = ps.SQLSelect

---

<div class="post-metadata">

**Author:** ![system](https://forum.xojo.com/uploads/default/original/1X/455b4dcc0e61630e9f81940004ddffa49c432a46.png) [@system](https://forum.xojo.com/u/system)\
**Post date:** [October 29, 2020, 7:33pm UTC](https://forum.xojo.com/t/sqlite-select-using-a-variable-as-a-condition/47265/5 "2020-10-29T19:33:02Z")

</div>