Hi madhan,
Hello, will this change affect any existing custom sql scripts?
It should not, basically sqlQuery_ = queryBox_->GetValue(); has been replaced by
sqlQuery_ = wxString::Format(queryBox_->GetValue().c_str()
, mmCleanString(customVal1->GetValue()).c_str()
, mmCleanString(customVal2->GetValue()).c_str()
, mmCleanString(customVal3->GetValue()).c_str()
, mmCleanString(customVal4->GetValue()).c_str()
);
Where customVal1,etc are just the added textbox on the form.
I've tested sql scripts with & without parameters.
This is just a quick way to add support for parametrized query . I'm aware that it I can make some SQL injection here (since it just uses the Format() method).
I'm not really sure how to make this more robust & user friendly : instead of using %1$s something like %1 or {1},... as well as input validation to avoid SQL injection.
On a side note, I've received the following questions from Nikolay wi
And how to translate Param1, 2 etc to other languages
-> I'm not sure how mmex does it's translations.
But when you start Custom SQL Dialog the cursor in the field Param1 but not in Custom SQL Query.
-> I don't know how to set the focus in WxWidget in the correct user control.