如何使用带有两个参数的android SQLITE SELECT？

Question

此代码返回空光标。这里有什么问题？ 数据已经存在于 sqlitedb 中。

public static final String COL_2 =  "ID";
    public static final String COL_3 = "TYPE";

public Cursor checkData(String id, String type){
    SQLiteDatabase db = getWritableDatabase();
    Cursor res = db.rawQuery("SELECT * FROM "+ TABLE_NAME  + " WHERE " + COL_2 + " = " + id+ " AND " + COL_3 + " = " + type , null);
    return res;
}

Answer 1

当您将字符串作为参数传递时，您必须在 sql 语句中引用它们。
但是通过在 sql 代码中连接带引号的字符串值，您的代码是不安全的。

推荐的方法是使用? 占位符：

public Cursor checkData(String id, String type){
    SQLiteDatabase db = getWritableDatabase();
    String sql = "SELECT * FROM "+ TABLE_NAME  + " WHERE " + COL_2 + " = ? AND " + COL_3 + " = ?";
    Cursor res = db.rawQuery(sql , new String[] {id, type});
    return res;
}

参数id 和type 在rawQuery() 的第二个参数中作为字符串数组传递。

Answer 2

我终于解决了。

public Cursor checkData(String id, String type){
        SQLiteDatabase db = getWritableDatabase();
        Cursor res = db.rawQuery("SELECT * FROM "+ TABLE_NAME  + " WHERE " + COL_2 + " = '" + id+ "' AND " + COL_3 + " =  '" + type +"'" , null);
        return res;
    }

Answer 3

如果 COL_3 类型是字符串，试试这个：

Cursor res = db.rawQuery("SELECT * FROM "+ TABLE_NAME  + " WHERE " + COL_2 + " = " + id+ " AND " + COL_3 + " = '" + type + "'" , null);