SQLite table name from textbox value

Question

I want to create a table name in SQLite based on the user inputted textbox value or a declared string value. For example:

cmd.CommandText = @"CREATE TABLE '"+Machine_Name.Text+"' AS (Date, Cal_Date) VALUES (@Date, @CalDate)";

I'm receiving a newline in constant error right before the AS. I know this may be bad database design but it would be helpful for me to do it this way.

Hopefully the user will remember what name they gave the table next time. — Ňɏssa Pøngjǣrdenlarp, Aug 08 '16 at 19:51

score 2 · Answer 1 · answered Aug 08 '16 at 19:37

2

Your query syntax seems to be mixed up.

If you want to create table, you have to provide the column spec (names and datatypes), or if you use create table as, a valid select query has to be used to define the column names/types.

The last part of your statement with the values clause is a valid form for an INSERT, but not for a create table.

See the Documentation here for details.

answered Aug 08 '16 at 19:37

SlimsGhost

2,849
1
10
16

Thank you. I thought you could make table and insert values as well. – LitteringAnd Aug 08 '16 at 20:15

score 1 · Accepted Answer · edited May 23 '17 at 11:51

1

The syntax to create a table is the following

cmd.CommandText = @"CREATE TABLE '" + newTable + "'" + 
                   "(DATE DATETIME, CAL_DATE VARCHAR(256))";

This of course assumes that your fields are a DateTime and a VarChar.
In other words, after the tablename you put, between parenthesys, the name of the columns and their datatype.

I suggest also to pay particular attention to the value your user types for the name of the new table. This liberty to type anything could be very dangerous and it is the basic building block when a malicious user tries to create an Sql Injection attack.

edited May 23 '17 at 11:51

Community

1
1

answered Aug 08 '16 at 19:38

Steve

213,761
22
232
286

Thank you for the answer and extra input. I have restrictions for all textboxes. This is just a simple local network program with very few users. It's not web based at all. I'll keep that in mind if I develop it further. The reason I'm doing it this way is because updating in sqlite is a bit of a pain. It only uses rowid to update values. – LitteringAnd Aug 08 '16 at 20:15

score 0 · Answer 3 · answered Jun 08 '20 at 14:18

0

           string ct = "Create table  '" + Textbox1.Text +"'(Column1, Column2)";
           SQLiteCommand createCommand1 = new SQLiteCommand(ct, sqliteCon);


                createCommand1.ExecuteNonQuery();
                sqliteCon.Close();
                MessageBox.Show("Data Saved");

            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message);
            }

answered Jun 08 '20 at 14:18

Rajashekar

1

1

Putting a bit more details and comments as to how your answer helps would be nice. – Anuj Pandey Jun 08 '20 at 14:28

SQLite table name from textbox value

3 Answers3