seerkong / abatis Goto Github PK

I have checked your souce code of this tool. I found this part of method 
executeForMapList:

...
 if (bindParams != null) {
            Iterator<String> mapIterator = bindParams.keySet().iterator();
            while (mapIterator.hasNext()) {
                String key = mapIterator.next();
                Object value = bindParams.get(key);
                sql = sql.replaceAll("#" + key.toLowerCase() + "#", value == null ? null : "'" + value.toString() + "'");
            }
        }
        if (sql.indexOf('#') != -1) {
            Log.e(TAG, "undefined parameter");
            return null;
        }
        Cursor cursor = dbObj.rawQuery(sql, null);
...


I don't understand why you don't use parameters (placeholders) in sql queries. 
I suggest to rewrite this part to (not tested!):


...
 if (bindParams != null) {
            Iterator<String> mapIterator = bindParams.keySet().iterator();
            int index = 0;
            String[] values = new String[bindParams.keySet().size()];
            while (mapIterator.hasNext()) {
                String key = mapIterator.next();
                Object value = bindParams.get(key);
                sql = sql.replaceAll("#" + key.toLowerCase() + "#", value == null ? null : "?"+(index+1));
                if(value != null){
                  values[index] = value.toString();
                  index++;
                }                
            }
        }
        if (sql.indexOf('#') != -1) {
            Log.e(TAG, "undefined parameter");
            return null;
        }
        Cursor cursor = dbObj.rawQuery(sql, values);
...