Return string in SQLITE query

Question

I need to return a user’s name in an SQLITE query: I’m using the following code:

public String verificarUsuario(String login)
    {

        try
        {

        String selectQuery = "select nome from usuarios where login = " + login;

        Cursor cursor = db.rawQuery(selectQuery, null);
        cursor.moveToFirst();

        String nomeString = cursor.getString(cursor.getColumnIndex("tipoFunc"));

        StringBuilder conversor = new StringBuilder();
        conversor.append(nomeString);
        return conversor.toString();


        }

But the following error is appearing:

no such column: lgomes (code 1): , while compiling: select name from usuarios Where login=lgomes

Answer 1

The user name must be in quotes to represent a string.

If you do not use quotes the database will try to compare the column login with another column. See the error message:

in such column: lgomes

In free translation

No column called lgomes

Your code should be something like:

String selectQuery = "select nome from usuarios where login = '" + login + "'";

The second mistake is why you have to use the index column:

String nomeString = cursor.getString(cursor.getColumnIndex("nome"))

---

It would be good to note that riding darlings concatenating strings can make your application susceptible to SQL injection attacks. Be careful with this.

Read these questions if you want to learn more.

• Why parameterized SQL queries (name = ?) prevent SQL Injection?
• How to prevent SQL code injection into my PHP code (It’s in PHP, but the general idea is the same).
• What is the question mark in a query?
• It is better to parameterize your Preparedstatement even if the value is fixed?
• How an SQL Injection Happens?