What is the purpose of "String[] whereArgs" in "int delete (String table, String whereClause, String[] whereArgs)" function?

Question

String[] whereArgs also present in update function of SQLiteDatabase class, what does it depicts?? I've read the documentation but not getting it,Please help. Thanks in Advance !!

Answer 1

As the documentation says, it's used for ? markers in your query string. For example, you might use this:

SQLiteDatabase.delete("users", "user_name = ?", new String[] {"Talib"});

The use of parameter markers is very important for avoiding SQL injection. For example,

SQLiteDatabase.delete("users", "user_name = ?", new String[] {"' OR '' = '"});

will not delete all rows of your table, but if you naively did

SQLiteDatabase.delete("users", "user_name = '" + userName + "'");

and userName was set to "' OR '' = '", that would indeed nuke your whole table.

Answer 2

If your whereClause is of the form somecolumn=?, the first element out of whereArgs will be used to replace the ?. These are called positional parameters. The advantage of using positional parameters is that SQLite will handle quoting the string, escaping any embedded quotes, etc.