Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed last month.
Improve this question
I would like to know if there is another way to insert a variable in prepare preventing sql injection
I tried that way but it leaves cause vulnerability i am using QSqlQuery class from qt to perform queries
query.prepare("update coins_tb set VALUE='"+QString::fromStdString(match.str(2))+"' where TOKEN='"+QString::fromStdString(match.str(1))+"'");
Here is an example from Qt docs:
QSqlQuery query;
query.prepare("INSERT INTO person (id, forename, surname) "
"VALUES (:id, :forename, :surname)");
query.bindValue(":id", 1001);
query.bindValue(":forename", "Bart");
query.bindValue(":surname", "Simpson");
query.exec();
And with your query it looks like:
query.prepare("update coins_tb set VALUE=:value where TOKEN=:token");
query.bindValue(":value", QString::fromStdString(match.str(2)));
query.bindValue(":token", QString::fromStdString(match.str(1)));
query.exec();
Related
Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 1 year ago.
Improve this question
I am trying to extract "Purchase Id: XXXXXXXX" for the following rows in a pandas dataframe but I am not sure of the correct regex expression to select starts with Purchase Id and ends after the digits.
What I have now:
Description
"Online order Purchase Id: 14527903 Charge Id: 11111111"
"Online order Purchase Id: 90762134 Charge Id: 33345872"
The desired result:
Description
Purchase Id: 14527903
Purchase Id: 90762134
Try this to match any number of digits after Product Id: :
df['Description'].str.extract('(Purchase Id: \d+)')
or this to match 8 characters after Product Id: :
df['Description'].str.extract('(Purchase Id: .{8})')
Output:
0
0 Purchase Id: 14527903
1 Purchase Id: 90762134
This is my first post in stack-overflow, so sorry in advance for possible "bad practices".
Context: the goal is to send SPARQL queries through http-requests to a GraphDB data base.
Problem: to construct the queries on code in a safe way. Currently done by means of std::string dummyStr = "Hello"+" World" or dummyStr.append("bla") (I was told this was not safe due to XSS, but thats not the issue here)
Question: do you know any query builder library for doing this string concatenation?
A search for C++ query builder on the web returned this answer.
After implementing the approach with the suggested Qt QSqlQuery class, I'm able to ".prepare" the query, but not to ".bindValue".
QSqlDatabase db = QSqlDatabase::addDatabase("QSQLITE");
db.open();
QSqlQuery startQuery;
/*Prepare query*/
startQuery.prepare("INSERT INTO person (id, forename, surname) "
"VALUES (:id, :forename, :surname)");
startQuery.bindValue(":id", 1001);
startQuery.bindValue(":forename", "Bart");
startQuery.bindValue(":surname", "Simpson");
/*convert query to std::string*/
QString startQueryString = startQuery.lastQuery();
std::string dummyQuery = startQueryString.toUtf8().constData();
Why can't I bind the values to the placeholders?
Is it because I have no "actual" database, but rather a dummy-database just to construct the query?
My actual Query looks something like this:
SELECT ?s WHERE { FILTER(STRSTARTS(STR(?s),":referenceIRI")). ?s rdf:type rdfs:Class.}
And I would like to treat :referenceIRI as a placeholder.
I've searched overall to try to overcome this problem, as I just need the query-builder functionality.
Also: on my actual SPARQL query I have both ? and :myVal elements, which are the 2 types of placeholders in QSqlQuery for binding values. Any idea on how to by-pass the ? placeholder and just consider the :myVal-type?
I have one table table1 (id, name, surname, ssn) and a view1 (id, ssn) and here is my update clause
update table1 set
ssn=v.ssn
from table1 t,view v
where t.id=v.id
However I get syntax error sql code -201, does anybody knows what is the problem?
Can you try:
UPDATE table1 SET ssn=(SELECT ssn FROM view WHERE table1.id=view.id)
PS You use strange names: table1, view. They say nothing about data in those tables/views. I hope this is only for this question.
You can use the MERGE statement.
But this depends the version of the Informix engine are you working (needs version 11.50 for this answer work).
Check this other similar question/answer answer for more information.
MERGE INTO table1 as t1
USING table2 as t2
ON t1.ID = t2.ID
WHEN MATCHED THEN UPDATE set (t1.col1, t1.col2) = (t2.col1, t2.col2);
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
Questions asking for code must demonstrate a minimal understanding of the problem being solved. Include attempted solutions, why they didn't work, and the expected results. See also: Stack Overflow question checklist
Closed 9 years ago.
Improve this question
I have a statement like this:
<cfif string contains "this" or string contains "that" or etc.>
The contains comes from a database that might be two or more things to search for in the if statement. How can I write the cfif to keep adding OR until all of the things to search for are in the if statement above?
There are a couple of ways to achieve your goal. One is to use list functions.
<cfif ListFind(ValueList(YourQuery.YourField), YourString) gt 0>
That would be appropriate if you want your string to be one of the values. Or you could do something like this, which would match the logic from your question.
</cfscript>
MyString = "DISCHARGE";
SearchResult = false;
</cfscript>
<cfquery name="x" datasource="dw">
select trim(event_name) event_name
from event
</cfquery>
<cfloop query="x">
<cfif MyString contains event_name >
<cfset SearchResult = true>
<cfbreak>
</cfif>
</cfloop>
<cfdump var="#SearchResult#">
And then there is the ever popular query of queries.
<cfquery name="q2" dbtype="query">
select count(*) matches
from YourFirstQuery
where TheField like <cfqueryparam value="%#string#%">
</cfquery>
These all have slightly different logic, so you have to know what you want to do before you try to code it.
Problem with % n * %n in writable segment detected * C++ i Qt
I have program that process big data, that can't be modified. In one file we encounter "100% na" and application stop.
When I checked it with debuger, it return * %n in writable segment detected *.
I can't change visible that data, user must see "100% na". I thought of inserting some whitespace other then space after %.
Rewriting the whole applications is not a point. It runs on Windows and Linuks.
Currently the problem is in this code. I checked this in other places and it was the same. The variables are QStrings.
QSqlQuery query;
query.exec("insert into table_name ("+variable_with_columns_names+" values ("+variable_with_data_to_insert+");");
Do you have any ideas how to evade it?
edit
Prepare the query solved the problem in this spot. But it is breaking in others points. Update , Select ... where ...='100% na'(as variable), generating reports and other stuff. Whats more that this data is used by at least 5 modules, each using more then 5 data tables. So I will wait sometime, if anyone have other solution.
PS. One more question:
Why is "% n" interpreted as "%n", when it shouldn't?
Funny thing is if I change "100% na" to "100%% na", I get in data base "100%% na" when it should be changed to "100% na".
Use prepare to prepare the query. Then insert the values using bindValue. Prepared statements should always be used in such scenarios, as they handle the escaping of special characters for you.
QSqlQuery query;
query.prepare("INSERT INTO person (id, forename, surname) "
"VALUES (:id, :forename, :surname)");
query.bindValue(0, 1001);
query.bindValue(1, "Bart");
query.bindValue(2, "Simpson");
query.exec();
QSqlQuery query;
query.prepare("INSERT INTO person (id, forename, surname) "
"VALUES (:id, :forename, :surname)");
query.bindValue(":id", 1001);
query.bindValue(":forename", "Bart");
query.bindValue(":surname", "Simpson");
query.exec();
QSqlQuery query;
query.prepare("INSERT INTO person (id, forename, surname) "
"VALUES (?, ?, ?)");
query.bindValue(0, 1001);
query.bindValue(1, "Bart");
query.bindValue(2, "Simpson");
query.exec();
QSqlQuery query;
query.prepare("INSERT INTO person (id, forename, surname) "
"VALUES (?, ?, ?)");
query.addBindValue(1001);
query.addBindValue("Bart");
query.addBindValue("Simpson");
query.exec();
any of these help?