I have this query( the parameters of the query are given by input: both table and name and password are string given by text field.  //... ResultSet rs = st.executeQuery("select * " +                                 "from `"+ table + "` " +                                "where Name='" + name + "' " +                                 "  and Password='" + password + "'");   and after this i don't understand why i can't enter in this if:  else if (table=="products"){     // ... }    and therefore I can not go along with the program
93
I've been using the == operator in my program to compare all my strings so far. However, I ran into a bug, changed one of them into .equals() instead, and it fixed the bug.  Is == bad? When should it and should it not be used? What's the difference?
118445
I am trying to write a condition into a SQL WHERE clause that forces the column comparison to a variable to be compared in lowercase. However the addExpression function isn't accomplishing this (since that is putting the expression in the field selection, not the where clause.  Here is what I have tried:  $category = 'mobile wifi'; $query = db_select('taxonomy_term_data', 'ttd')     -&gt;fields('ttd', array('tid')); $query-&gt;innerJoin('taxonomy_vocabulary', 'tv', 'ttd.vid = tv.vid'); $query-&gt;addExpression("LOWER(ttd.name) = $category"); $result = $query-&gt;condition('machine_name', 'images_cat', '=')     -&gt;execute()     -&gt;fetchAssoc();   And this:  $category = 'mobile wifi'; $query = db_select('taxonomy_term_data', 'ttd')     -&gt;fields('ttd', array('tid')); $query-&gt;innerJoin('taxonomy_vocabulary', 'tv', 'ttd.vid = tv.vid'); $result = $query-&gt;condition('machine_name', 'images_cat', '=')     -&gt;condition('LOWER(ttd.name)', $category, '=')     -&gt;execute()     -&gt;fetchAssoc();   The second one becomes invalid and the first one causes the problem I mentioned above. Any thoughts or suggestions?  Thanks, Patrick
120263
I'm trying to implement optional parameters in a stored procedure that I have but I am running into a problem. Here's a simplified query to illustrate the issue:  SET ANSI_NULLS OFF  DECLARE @MiddleName VARCHAR(20); SET @MiddleName = NULL;  SELECT * FROM [Customer] WHERE [LastName] = 'Torres' AND [MiddleName] = COALESCE(@MiddleName, [MiddleName])   When I run this query I need to get one row back because one Torres has NULL in the [MiddleName] column. But the query returns zero rows. Using IFNULL() produces the same result. From researching COALESCE, I was under the impression that NULL would be returned if all expressions are NULL. As I am not a SQL expert I assume that I am missing something, but what is it.....  Thanks in advance for any help.
13630
I have a simple query:  SELECT u_name AS user_name FROM users WHERE user_name = "john";   I get Unknown Column 'user_name' in where clause.  Can I not refer to 'user_name' in other parts of the statement even after select 'u_name as user_name'?
47691
I've heard that "everyone" is using parameterized SQL queries to protect against SQL injection attacks without having to vailidate every piece of user input.  How do you do this?  Do you get this automatically when using stored procedures?  So my understanding this is non-parameterized:    cmdText = String.Format("SELECT foo FROM bar WHERE baz = '{0}'", fuz)   Would this be parameterized?  cmdText = String.Format("EXEC foo_from_baz '{0}'", fuz)   Or do I need to do somethng more extensive like this in order to protect myself from SQL injection?  With command     .Parameters.Count = 1     .Parameters.Item(0).ParameterName = "@baz"     .Parameters.Item(0).Value = fuz End With   Are there other advantages to using parameterized queries besides the security considerations?  Update:  This great article was linked in one of the questions references by Grotok.
38112
Here's the scenario...    if (entry.Properties["something"].Value != null)   attribs.something = entry.Properties["something"].Value.ToString();   While effective and working correctly, this looks ugly to me.  If I don't check for a null before performing the ToString() then it throws an exception if the property was null.  Is there a better way to handle this scenario?  Much appreciated!
58526
As mentioned in , it's possible to use bind variables in dynamic SOQL queries.  This seems like a great way to avoid SOQL-injection, and to build a query string once but use it multiple times with different values in the variables.  I'm working on a method that returns a list of objects.  It accepts a class with multiple properties as its only parameter.  The properties of this class are used to filter the results to just the required records.  It will eventually be driven by a Visualforce component, which will be configured by querystring parameters in the URL.  I just ran into an issue where the query fails when I use dotted bind variables.  If I copy the constructed dynamic SOQL into a static query, it works fine.  This may be a bug, because in doing tests I found that :foo.bar would actually try to use local variable bar.  Here's one of my queries, which uses related custom objects.  I've stripped it down to just the part that's failing (wrapped for legibility):  result = Database.query('SELECT Name, Another_Object__r.Name,      Another_Object__r.Custom_Field__c      FROM Custom_Object__c       WHERE Another_Object__r.Custom_Field__c = :filter.deviceType');   The error reported is System.QueryException: Variable does not exist: filter.deviceType.  As mentioned above, the query works fine as static SOQL, just not dynamic:  result = [SELECT Name, Another_Object__r.Name, Another_Object__r.Custom_Field__c FROM Custom_Object__c WHERE Another_Object__r.Custom_Field__c = :filter.deviceType];   It also works in this case:  String deviceType = filter.deviceType; Database.query('SELECT Name, Another_Object__r.Name, Another_Object__r.Custom_Field__c FROM Custom_Object__c WHERE Another_Object__r.Custom_Field__c = :deviceType');   I haven't read about this being a known limitation.  I don't know if I should be using some other syntax/notation in the query -- the dotted notation appears correct.  Time to report a bug?  Thoughts on workarounds other than creating local variables to stand in for each member of the class?
104197
When i create new User Account and login with that credentials, it gives me this problem if admin doesnt have set thier values yet !!!**  AllotmentList = [select id, Days_Remaining__c from PTO_Allotment__c where Year__c =:year and Employee__c=:EmployeeList[0].id LIMIT 100]; //access only Current user Allotment details                 //to handle Listoutof Bound Exception wrote if-else          if(AllotmentList.size()&gt;0)         {         requests.PTO_Allotment__c=AllotmentList[0].id;         requests.Days_Remaining__c=AllotmentList[0].Days_Remaining__c;         }         else         {             //write a code when AllotmentList is empty ....         }
4667
Getting error with this code but I can't figure it out  trigger LeadConvert on Lead (after insert) {     list leadsToConvert = new list();      Database.LeadConvert lc;     string convertedStatus = '';     list convertStatusList = new list();     convertStatusList = [Select Id, MasterLabel                          from LeadStatus where IsConverted=true limit 1];     if(convertStatusList.size() &gt; 0){         convertedStatus = convertStatusList[0].MasterLabel;         }     else{              convertedStatus = 'Closed - Converted';          }      for(Lead l : trigger.New){         if(l.AutoConvert__c == true){             lc = new database.LeadConvert();             lc.setLeadId(l.ID);             lc.setDoNotCreateOpportunity(true);              lc.setConvertedStatus(convertedStatus);             leadsToConvert.add(lc);         }     }      list lcrList = new list();     lcrList = Database.convertLead(leadsToConvert); }
49111
How do I use prepared statements in SQlite in Android?
13332
I am trying to use a  as input and then creating a query with it - so I need a .    I was surprised to find that it couldn't do the conversion implicitly or explicitly - but I don't even know how I would do this, as the Java API is still fairly new to me.
58103
I was answering a question and this little inconsistency popped up.  Just wondering if anyone has come across it before, or if anyone knows why this happens.  A variable that is declared within some form of scoped element (if, for loop, etc.) shouldn't be available outside that scope.  i.e.  {     // accountNames variable is not available outside this scope     Set&lt;String&gt; accountNames = new Set&lt;String&gt; {'Test Account'}; }  system.debug(accountNames);   This debug statement fails with the message:      Variable does not exist: accountNames   However, if this is part of a query string being generated, the Database.query() call somehow has access to it.  String queryString = 'SELECT Id, Name FROM Account';  if(true) {     // accountNames variable is not available outside the `if` statement     Set&lt;String&gt; accountNames = new Set&lt;String&gt; {'Test Account'};     queryString += ' WHERE Name IN :accountNames'; }  // this debug will fail if you uncomment it // system.debug(accountNames);  // however the query somehow has access to it. // create an account called Test Account to prove it.  system.debug('queryString: ' + queryString); system.debug('queryString result: ' + database.query(queryString));   But, Salesforce is smart enough to know that it's not just some random string, so the following will fail:  // Alternatively, use a random string as the variable name, and salesforce  // is smart enough to know it's gibberish String queryString2 = 'SELECT Id, Name FROM Account';  if(true) {     queryString2 += ' WHERE Name IN :randomString'; }  try {     system.debug('queryString2 result: ' + database.query(queryString2));     system.assert(false); } catch (QueryException qe)  {     system.debug(':randomString is gibberish: ' + qe.getMessage()); }     Edit:  Interestingly, the :randomString is definitely calculated only when the query is executed.  String queryString3 = 'SELECT Id, Name FROM Account'; String queryString4 = 'SELECT Id, Name FROM Account';  if(true) {     // assign to query 3 before it has a value     queryString3 += ' WHERE Name IN :randomString';      // assign to query 4 after it has been declared     Set&lt;String&gt; randomString = new Set&lt;String&gt;{'Test Account'};     queryString4 += ' WHERE Name IN :randomString'; }  // both queries return correct results, regardless of when the variable was declared system.debug('queryString3 result: ' + database.query(queryString3)); system.debug('queryString4 result: ' + database.query(queryString4));   But it's not an open slather.  The following throws an error:  String queryString = 'SELECT Id, Name FROM Account WHERE Name = :someField'; someMethod(); system.debug('queryString result: ' + database.query(queryString));  void someMethod() {     String someField = 'Test Account';     system.debug('someField: ' + someField); }     Does anyone know why this is the case, or have an explanation why this would work?  As far as I can tell, at the time that the accountNames variable is in scope, no part of the code knows that it's anything other than a string.
14196
I realize that CHAR is recommended if all my values are fixed-width. But, so what? Why not just pick VARCHAR for all text fields just to be safe.
59128
I am writing a stored procedure where I have an input parameter called my_size that is an INTEGER. I want to be able to use it in a LIMIT clause in a SELECT statement. Apparently this is not supported, is there a way to work around this?  # I want something like: SELECT * FROM some_table LIMIT my_size;  # Instead of hardcoding a permanent limit: SELECT * FROM some_table LIMIT 100;
14134
I had to write a simple query where I go looking for people's name that start with a B or a D :   SELECT s.name  FROM spelers s  WHERE s.name LIKE 'B%' OR s.name LIKE 'D%' ORDER BY 1   I was wondering if there is a way to rewrite this to become more performant. So I can avoid or and / or like?
108771
In the below scenario  i am Accepting the ID of object in the string form : What will be the best way to avoid the SQL injection for ASId.  public static List&lt;AB__c&gt;ABC(string ASId)         records = [select id, name,abc__c,der__f, from AB__c WHERE der__f = :ASId WITH SECURITY ENFORCED ORDER BY AB__c ASC NULLS LAST];
62033
I have a question about comparing a string with the empty string in Java. Is there a difference, if I compare a string with the empty string with == or equals? For example:  String s1 = "hi";  if (s1 == "")   or   if (s1.equals(""))    I know that one should compare strings (and objects in general) with equals, and not ==, but I am wondering whether it matters for the empty string.