sql code not work
lazarus / 16-Databases

----------------------------------------------------------------------
cryptid · 2021-04-02 08:17

sql code not work

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i procedure
TForm1.Edit1KeyPress(Sender: TObject; var Key: char);begin  with
SQLQuery1 do    begin       SQL.Clear;       SQL.Add('select * from
log WHERE user LIKE"'+Edit1.Text+'%"');       Active:=True;    
end;end;
[Edited to add code tags: Please see How to use the Forum.]

----------------------------------------------------------------------
ttomas · 2021-04-02 08:33

I don't see SPACE after LIKE

----------------------------------------------------------------------
MarkMLl · 2021-04-02 08:38

Quote from: ttomas on April 02, 2021, 10:33:22 amI don't see SPACE
after LIKE

Well spotted, probably needs ' %'

MarkMLl

----------------------------------------------------------------------
egsuh · 2021-04-02 09:34

Using format can be of help.

SQL.Text:= Format('select * from log where user like ''%s%%'';', 
[Edit1.Text]);

%s is replaced by Edit1.Text. %% is read as %.

----------------------------------------------------------------------
PierceNg · 2021-04-02 10:03

SQL string construction is vulnerable to SQL injection. Should use
parameterization:

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i SQL.Text:=
'select * from log where user like
:PATTERN;';Params.ParamsByName('PATTERN').AsString := Edit1.Text;
See https://bobby-tables.com/.

----------------------------------------------------------------------
flori · 2021-04-02 11:30

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i SQLQuery1.A
ctive:=false;SQLQuery1.SQL.Clear;SQLQuery1.SQL.Append('select * from
log WHERE user LIKE '''+edit1.Text+'%''');SQLQuery1.Active:=true