Your cart is currently empty!
Category: sqlite
-
Khóa học miễn phí SQLite – Transactions nhận dự án làm có lương
SQLite – Transactions
A transaction is a unit of work that is performed against a database. Transactions are units or sequences of work accomplished in a logical order, whether in a manual fashion by a user or automatically by some sort of a database program.
A transaction is the propagation of one or more changes to the database. For example, if you are creating, updating, or deleting a record from the table, then you are performing transaction on the table. It is important to control transactions to ensure data integrity and to handle database errors.
Practically, you will club many SQLite queries into a group and you will execute all of them together as part of a transaction.
Properties of Transactions
Transactions have the following four standard properties, usually referred to by the acronym ACID.
-
Atomicity − Ensures that all operations within the work unit are completed successfully; otherwise, the transaction is aborted at the point of failure and previous operations are rolled back to their former state.
-
Consistency − Ensures that the database properly changes states upon a successfully committed transaction.
-
Isolation − Enables transactions to operate independently of and transparent to each other.
-
Durability − Ensures that the result or effect of a committed transaction persists in case of a system failure.
Transaction Control
Following are the following commands used to control transactions:
-
BEGIN TRANSACTION − To start a transaction.
-
COMMIT − To save the changes, alternatively you can use END TRANSACTION command.
-
ROLLBACK − To rollback the changes.
Transactional control commands are only used with DML commands INSERT, UPDATE, and DELETE. They cannot be used while creating tables or dropping them because these operations are automatically committed in the database.
BEGIN TRANSACTION Command
Transactions can be started using BEGIN TRANSACTION or simply BEGIN command. Such transactions usually persist until the next COMMIT or ROLLBACK command is encountered. However, a transaction will also ROLLBACK if the database is closed or if an error occurs. Following is the simple syntax to start a transaction.
BEGIN; or BEGIN TRANSACTION;
COMMIT Command
COMMIT command is the transactional command used to save changes invoked by a transaction to the database.
COMMIT command saves all transactions to the database since the last COMMIT or ROLLBACK command.
Following is the syntax for COMMIT command.
COMMIT; or END TRANSACTION;
ROLLBACK Command
ROLLBACK command is the transactional command used to undo transactions that have not already been saved to the database.
ROLLBACK command can only be used to undo transactions since the last COMMIT or ROLLBACK command was issued.
Following is the syntax for ROLLBACK command.
ROLLBACK;
Example
Consider table with the following records.
ID NAME AGE ADDRESS SALARY ---------- ---------- ---------- ---------- ---------- 1 Paul 32 California 20000.0 2 Allen 25 Texas 15000.0 3 Teddy 23 Norway 20000.0 4 Mark 25 Rich-Mond 65000.0 5 David 27 Texas 85000.0 6 Kim 22 South-Hall 45000.0 7 James 24 Houston 10000.0
Now, let”s start a transaction and delete records from the table having age = 25. Then, use ROLLBACK command to undo all the changes.
sqlite> BEGIN; sqlite> DELETE FROM COMPANY WHERE AGE = 25; sqlite> ROLLBACK;
Now, if you check COMPANY table, it still has the following records −
ID NAME AGE ADDRESS SALARY ---------- ---------- ---------- ---------- ---------- 1 Paul 32 California 20000.0 2 Allen 25 Texas 15000.0 3 Teddy 23 Norway 20000.0 4 Mark 25 Rich-Mond 65000.0 5 David 27 Texas 85000.0 6 Kim 22 South-Hall 45000.0 7 James 24 Houston 10000.0
Let”s start another transaction and delete records from the table having age = 25 and finally we use COMMIT command to commit all the changes.
sqlite> BEGIN; sqlite> DELETE FROM COMPANY WHERE AGE = 25; sqlite> COMMIT;
If you now check COMPANY table is still has the following records −
ID NAME AGE ADDRESS SALARY ---------- ---------- ---------- ---------- ---------- 1 Paul 32 California 20000.0 3 Teddy 23 Norway 20000.0 5 David 27 Texas 85000.0 6 Kim 22 South-Hall 45000.0 7 James 24 Houston 10000.0
Khóa học lập trình tại Toidayhoc vừa học vừa làm dự án vừa nhận lương: Khóa học lập trình nhận lương tại trung tâm Toidayhoc
-
Khóa học miễn phí SQLite – Injection nhận dự án làm có lương
SQLite – Injection
If you take user input through a webpage and insert it into a SQLite database there”s a chance that you have left yourself wide open for a security issue known as SQL Injection. In this chapter, you will learn how to help prevent this from happening and help you secure your scripts and SQLite statements.
Injection usually occurs when you ask a user for input, like their name, and instead of a name they give you a SQLite statement that you will unknowingly run on your database.
Never trust user provided data, process this data only after validation; as a rule, this is done by pattern matching. In the following example, the username is restricted to alphanumerical chars plus underscore and to a length between 8 and 20 chars – modify these rules as needed.
if (preg_match("/^w{8,20}$/", $_GET[''username''], $matches)){ $db = new SQLiteDatabase(''filename''); $result = @$db->query("SELECT * FROM users WHERE username = $matches[0]"); } else { echo "username not accepted"; }
To demonstrate the problem, consider this excerpt −
$name = "Qadir DELETE FROM users;"; @$db->query("SELECT * FROM users WHERE username = ''{$name}''");
The function call is supposed to retrieve a record from the users table where the name column matches the name specified by the user. Under normal circumstances, $name would only contain alphanumeric characters and perhaps spaces, such as the string ilia. However in this case, by appending an entirely new query to $name, the call to the database turns into a disaster: the injected DELETE query removes all records from users.
There are databases interfaces which do not permit query stacking or executing multiple queries in a single function call. If you try to stack queries, the call fails but SQLite and PostgreSQL, happily perform stacked queries, executing all of the queries provided in one string and creating a serious security problem.
Preventing SQL Injection
You can handle all escape characters smartly in scripting languages like PERL and PHP. Programming language PHP provides the function string sqlite_escape_string() to escape input characters that are special to SQLite.
if (get_magic_quotes_gpc()) { $name = sqlite_escape_string($name); } $result = @$db->query("SELECT * FROM users WHERE username = ''{$name}''");
Although the encoding makes it safe to insert the data, it will render simple text comparisons and LIKE clauses in your queries unusable for the columns that contain the binary data.
Note − addslashes() should NOT be used to quote your strings for SQLite queries; it will lead to strange results when retrieving your data.
Khóa học lập trình tại Toidayhoc vừa học vừa làm dự án vừa nhận lương: Khóa học lập trình nhận lương tại trung tâm Toidayhoc