iphone - 如何将加密的数据插入sqlite。插入加密数据时出现错误

如何将加密的数据插入sqlite。插入加密数据时出现错误。 bcos加密了这么多的单引号和双引号，因此在创建我的sql时，字符串中断了。还有其他方法可以插入数据而不会丢失数据。
我也害怕使用bsoc的添加斜杠方法，它可能会改变我的实际加密数据。任何人都可以给我建议。.也请在下面找到我的插入查询功能

-(BOOL) insertItemData:(NSString *)encryptedData folderId:(NSString *)folderId
{
   bool giveBackValue = 0;

   database = [[[DBConnection alloc] init] autorelease];

  if(sqlite3_open([[database filePath] UTF8String], &db) == SQLITE_OK)
  {
    NSString *sql = [[[NSString alloc] initWithFormat:@"INSERT INTO tbl_content (FolderId, Content) VALUES ('%@', '%@');", folderId, encryptedData] autorelease];
    NSLog(@"%@",sql);
    char *sqlError;
    if(sqlite3_exec(db, [sql UTF8String], nil, nil, &sqlError) == SQLITE_OK)
    {
        giveBackValue = 1;
    }
    else
    {
        //Query exec failed

    }
}
else
{
    //DB Open failed
}

return giveBackValue;
}

我的选择查询功能

-(void)getFirstJsonListInFolder:(NSString *)folderId listCarrier:(NSMutableArray **)listCarrier
{
    database = [[[DBConnection alloc] init] autorelease];
    NSMutableArray *dummyListCarrier = [[[NSMutableArray alloc] init] autorelease];

    if (sqlite3_open([[database filePath] UTF8String], &db) ==SQLITE_OK)
    {
        NSString *sql = [[NSString alloc] initWithFormat:@"SELECT Content from tbl_content WHERE FolderId = '%@'", folderId];

    sqlite3_stmt *result;
    if(sqlite3_prepare_v2(db, [sql UTF8String], -1, &result, nil) == SQLITE_OK)
    {
        while (sqlite3_step(result) == SQLITE_ROW)
        {
            char *contentList = (char *)sqlite3_column_text(result, 0);
            NSString *contentListString = [[NSString alloc] initWithUTF8String:contentList];
            [dummyListCarrier addObject:contentListString];
            [contentListString release];
        }
    }
    else
    {
        //Query exec failed
    }
}
else
{
    //DB Open failed
}
*listCarrier = dummyListCarrier;
}

最佳答案

您应该避免直接将值分配给sql语句中的列。相反，您应该使用预处理语句并将值绑定到该语句。

NSString *sql = @"INSERT INTO tbl_content (FolderId, Content) VALUES ('?', '?');";
char *sql = (char *) [sql UTF8String];
sqlite3_bind_text(stmt, 1, [Content UTF8String], -1, SQLITE_TRANSIENT);

*这不是完整的代码