EN Database via sinusbot code

[Alkowskey]

Hey guys, i've got a little problem.
<code>if (dbc) dbc.exec("INSERT INTO TOP (Nick, Uid, Ilsoc_Polaczen) VALUES ('qwe', 'zcx', 2)");</code>
it works but i want to have a variables instead of 'qwe' 'zcx' and 2.
ive tried this
<code>if (dbc) dbc.exec("INSERT INTO TOP (Nick, Uid, Ilsoc_Polaczen) VALUES ("+Nick+","+Uid"," + Connection_count+")");</code>
but it didnt work. Thanks!

 

[flyth]

Never ever use variables directly in the query string, as it potentially leads to SQL injection. Instead, use something like that:

dbc.exec('INSERT INTO TOP (Nick, Uid, Ilsoc_Placzen) VALUES (?, ?, ?)', Nick, Uid, Connection_count);

 

[Alkowskey]

Thats it! Thank You!

 

[kanalumaddela]

Never ever use variables directly in the query string, as it potentially leads to SQL injection. Instead, use something like that:

dbc.exec('INSERT INTO TOP (Nick, Uid, Ilsoc_Placzen) VALUES (?, ?, ?)', Nick, Uid, Connection_count);

That's prepared statements, right? And the last 3 are the actual values in that statement (nick, uid, connection_count for the ex)?

 

[Alkowskey]

i think so.