sqlite: importFromJson on android fails to build SQL Statement with `'` in values.
Describe the bug
Values may contain ' that are not escaped. This leads to syntax error, or sql injection breach.
To Reproduce
Using importFromJson, use a value with a '. That breaks the syntax.
Expected behavior
Escape ' chars in values to safely built the whole SQL statement.
Smartphone
- Device: Samsung Galaxy J5
- OS: android 9
About this issue
- Original URL
- State: closed
- Created 7 months ago
- Reactions: 1
- Comments: 19 (10 by maintainers)
@mmouterde As already said the @capacitor-community/sqlite will not support the reserved words in the table’s field name. In 5.5.1-1, the following will work:
as you will notice
L'awson has "nearly" somethingin an
executecommand:in a
runcommand:Voilà
@mmouterde I come back on this after futher tests on other platforms value like “O’Connor” works for web, iOS and Electron so it will be fixed for Android in next release.