ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Working with local SQL databases in AIR
Using unnamed parameters
Adobe AIR 1.0 and later
As an alternative to using named parameters, you can also use unnamed parameters. To use an unnamed parameter
you denote a parameter in a SQL statement using a “?” character. Each parameter is assigned a numeric index,
according to the order of the parameters in the statement, starting with index 0 for the first parameter. The following
example demonstrates a version of the previous example, using unnamed parameters:
var sql:String =
"INSERT INTO inventoryItems (name, productCode)" +
"VALUES (?, ?)";
var addItemStmt:SQLStatement = new SQLStatement();
addItemStmt.sqlConnection = conn;
addItemStmt.text = sql;
// set parameter values
addItemStmt.parameters[0] = "Item name";
addItemStmt.parameters[1] = "12345";
addItemStmt.execute();
Benefits of using parameters
Adobe AIR 1.0 and later
Using parameters in a SQL statement provides several benefits:
Better performance A SQLStatement instance that uses parameters can execute more efficiently compared to one that
dynamically creates the SQL text each time it executes. The performance improvement is because the statement is
prepared a single time and can then be executed multiple times using different parameter values, without needing to
recompile the SQL statement.
Explicit data typing Parameters are used to allow for typed substitution of values that are unknown at the time the SQL
statement is constructed. The use of parameters is the only way to guarantee the storage class for a value passed in to
the database. When parameters are not used, the runtime attempts to convert all values from their text representation
to a storage class based on the associated column's type affinity.
For more information on storage classes and column affinity, see “Data type support” on page 1114.
Greater security The use of parameters helps prevent a malicious technique known as a SQL injection attack. In a SQL
injection attack, a user enters SQL code in a user-accessible location (for example, a data entry field). If application
code constructs a SQL statement by directly concatenating user input into the SQL text, the user-entered SQL code is
executed against the database. The following listing shows an example of concatenating user input into SQL text. Do
not use this technique:
Last updated 6/6/2012
731