Shorten Dynamic SQL Query For Loop

I have a function that builds an sql query and then inserts it into the client-side light sql.

I think im using to many for loops, how would i make this shorter?

function insert(dataBase,table,row){
    var j = 0;

    var sqlQueryArray = [];

    sqlQueryArray[j++] = 'INSERT INTO ';
    sqlQueryArray[j++] = table
    sqlQueryArray[j++] = ' ('

    for (var i = row.length - 2; i >= 0; i--){
        sqlQueryArray[j++] = row[i].id + ',';
    };

    sqlQueryArray[j++] = row[(row.length - 1)].id + '';
    sqlQueryArray[j++] = ')'
    var sqlQueryString = ' VALUES ';

    for (var i = row开发者_如何学运维.length - 2; i >= 0; i--){
        sqlQueryArray[j++] = '?, ';
    };

    sqlQueryArray[j++] = '?';
    sqlQueryArray[j++] = ');'

    for (var i = 0; i < sqlQueryArray.length; i++){
        sqlQueryString += sqlQueryArray[i];
    }
    var rowArray = []
    for (var i = row.length - 1; i >= 0; i--){
        rowArray[i] = row[i].val;
    };

    dataBase.openDatabase.transaction(
        function (transaction) {
            transaction.executeSql(sqlQueryString,
                rowArray,
                dataBase.nullSQLHandler, dataBase.QueryError);
        }
    );
}

---

Assuming you're using a relatively recent browser, you could do something like this:

var insertStatement =
   'INSERT INTO ' + table +
   ' (' + rows.map(function (row) { return row.id; }).join(', ') + ')' +
   ' VALUES (' + rows.map(function () { return '?'; }).join(', ') + ')';

Whether you should or not is left as an exercise for the reader :)

Edit: I just noticed in a comment to another answer that you are sending this to the server for execution. You should definitely not do that, since a user could easily submit their own SQL and wreak all kinds of havoc on your database. You shouldn't trust any data received over the network.

---

Whenver Dynamic SQL is created in an application, things are unleashed and children are eaten.

You should really use a parameterized SP for this one for a multitude of security and performance reasons (not to mention readability/maintainability).

---

First of all, I think you'd be better not tracking the index manually (j++). Use sqlQueryArray.push() to insert the elements at the end of sqlQueryArray.

Then, to simplify your code, you can create a function that returns you a custom SQL passing your row variable as a parameter, with that you can generate the INSERT INTO clause with all the ? markers.