about sql injection

[KiritoStudio]

Does the '?' can really prevent the sql injection? I`m new in sqlite3.

[Mithgol]

Yes, it can. Numbered or named parameters also can. Things are generally safe until you use the JavaScript's plus (+) to concatenate something unsafe directly into a statement's SQL.

(Basically the same question was already answered in #57.)

[KiritoStudio]

@Mithgol Thanks for your reply, and what is the excepted behavior if there is '1=1' in the parameter?

[Mithgol]

Something like these results from Node.js REPL:

[KiritoStudio]

I see, Thanks a lot.

[Mithgol]

I guess the issue can be closed then.