Re: How to do simple variable substitution in sql querys

On Mon, Feb 24, 2003 at 10:45:45PM -0700, Jack wrote:
> I cannot figure out how to subsitute variables into the query string.
> Ex: $declare(String query = "Select * from transactions")
> Now, it'd be nice to understand how to make it so I didn't have to put
> the actual table name in there - transactions. Rather, I'd like to be
> able to have a query string such as: $declare(String query = "Select *
> from $table_name"), but this does not seem to work. How is this supposed
> to be done? 

You can put the table name into a different variable, and then add the two
strings together:

${
  String tableName = "transactions";
  String query = "select * from " + tableName;
}$

Or, if you wanted to grab the table name from a form parameter:

${
  use "codex.http";
  String query = "select * from " + getValue("tableName","");
}$

This way isn't very safe since attackers could pass naughty things along
to your sql statement, but its just an example of what you can do.

Good luck!

Cory

--
Cory Wright
Stand Blue Technology
http://www.standblue.net/