I'm executing an SQL statement on a .sqlite file in Ruby. I need to use a variable in the WHERE clause but I'm not sure of the syntax. Is that also how I save the result using the name variable?
total = 0.0
db = SQLite3::Database.open "Test2.sqlite"
for i in [email protected]
name = db.execute "SELECT price FROM Products WHERE product_code = {variable here}"
You can use a bind variable like this:
name = db.execute "SELECT price FROM Products WHERE product_code = ?", bind_variable_here
See http://sqlite-ruby.rubyforge.org/classes/SQLite/Database.html#M000078
You could use Ruby string interpolation, as your question suggests, to get the right result here but that is generally a bad idea because it could leave your application vulnerable to SQL injection.
