Use bindvalue in DatabaseTableView

src/database.cpp

@@ -307,6 +307,11 @@ QVector<SkyObject> Database::getObjects(double minRa, double maxRa, double minDe
     return objects;
 }
 
+const QSqlDatabase &Database::db() const
+{
+    return database;
+}
+
 bool Database::indexDir2(const QDir &dir, QProgressDialog *progress, QStringList &scannedDirs)
 {
     if(scannedDirs.contains(dir.canonicalPath()))return true;

src/database.h

@@ -42,6 +42,7 @@ public:
     void reindex(QProgressDialog *progress);
     QStringList getFitsKeywords();
     QVector<SkyObject> getObjects(double minRa, double maxRa, double minDec, double maxDec);
+    const QSqlDatabase& db() const;
 protected:
     bool indexDir2(const QDir &dir, QProgressDialog *progress, QStringList &scannedDirs);
     bool indexFile(const QFileInfo &file);

src/databaseview.cpp

@@ -163,26 +163,49 @@ void FITSFileModel::prepareQuery()
     QString join;
     QStringList where;
     QString sql = m_columns.size() ? "SELECT f.file," : "SELECT f.file";
+    QVariantList bindValues;
     for(int i=0; i<m_value.size(); i++)
     {
         if(m_key[i] == "file")
-            where.append(QString(" f.file LIKE '%1' ").arg(m_value[i]));
+        {
+            where.append(" f.file LIKE ? ");
+            bindValues.append(m_value[i]);
+        }
         else if(m_key[i] == "RA pos")
-            where.append(QString(" %1 BETWEEN f.minRa AND f.maxRa ").arg(RA(m_value[i])));
+        {
+            where.append(" ? BETWEEN f.minRa AND f.maxRa ");
+            bindValues.append(RA(m_value[i]));
+        }
         else if(m_key[i] == "DEC pos")
-            where.append(QString(" %1 BETWEEN f.minDec AND f.maxDec ").arg(DEC(m_value[i])));
+        {
+            where.append(" ? BETWEEN f.minDec AND f.maxDec ");
+            bindValues.append(DEC(m_value[i]));
+        }
         else if(m_key[i] == "RA range")
-            where.append(QString(" crVal1 BETWEEN %1 AND %2 ").arg(RA(m_value[i])).arg(RA(m_limit[i])));
+        {
+            where.append(" crVal1 BETWEEN ? AND ? ");
+            bindValues.append(RA(m_value[i]));
+            bindValues.append(RA(m_limit[i]));
+        }
         else if(m_key[i] == "DEC range")
-            where.append(QString(" crVal2 BETWEEN %1 AND %2 ").arg(DEC(m_value[i])).arg(DEC(m_limit[i])));
+        {
+            where.append(" crVal2 BETWEEN ? AND ? ");
+            bindValues.append(DEC(m_value[i]));
+            bindValues.append(DEC(m_limit[i]));
+        }
         else
-            join += QString(" JOIN fits_headers AS s%1 ON f.id=s%1.id_file AND s%1.key='%2' AND s%1.value LIKE '%3'").arg(i).arg(m_key[i]).arg(m_value[i]);
+        {
+            join += QString(" JOIN fits_headers AS s%1 ON f.id=s%1.id_file AND s%1.key=? AND s%1.value LIKE ?").arg(i);
+            bindValues.append(m_key[i]);
+            bindValues.append(m_value[i]);
+        }
     }
     int i=0;
     for(auto &column : m_columns)
     {
         cols += QString("GROUP_CONCAT(h%1.value) AS h%1_value,").arg(i);
-        join += QString(" LEFT JOIN fits_headers AS h%1 ON f.id=h%1.id_file AND h%1.key='%2'").arg(i).arg(column);
+        join += QString(" LEFT JOIN fits_headers AS h%1 ON f.id=h%1.id_file AND h%1.key=?").arg(i);
+        bindValues.append(column);
         i++;
     }
     cols.chop(1);
@@ -191,7 +214,16 @@ void FITSFileModel::prepareQuery()
     sql += join;
     if(!where.isEmpty())sql += " WHERE " + where.join("AND");
     sql += " GROUP BY f.id" + m_sort;
-    setQuery(sql);
+
+    QSqlQuery query(m_database->db());
+    query.prepare(sql);
+    for(int i = 0; i < bindValues.size(); i++)
+        query.bindValue(i, bindValues[i]);
+
+    if(!query.exec())
+        qWarning() << "Failed to exectute query" << query.lastQuery();
+    setQuery(std::move(query));
+
     setHeaderData(0, Qt::Horizontal, tr("File name"));
     i = 1;
     for(auto &column : m_columns)