I have a small program that manually creates queries. In pseudo code, it's basically done like this
string[] a = new string[x]; a[0] = "data 1"; a[1] = "data 2"; a[2] = "data 3"; string query = "insert into x (y) values("; for i { query += a开发者_如何学C[i] + ","; } query += ");";
I'm aware that this usage is sub-optimal and I should do a complete re-write at some point.
Now I need to add some binary data to the a-array. Given abyte[] b
, how can I add it to the query?
I haven't tried, but I'm assuming that b.toString()
or just query+=b
is gonna corrupt my data? Don't put it in the SQL to start with. Use a parameterized query: it'll be a lot easier, and won't risk SQL injection attacks.
精彩评论