Filter Inputs to ContentProvider User Functions

Question

In the custom ContentProvider I need to filter out some of the columns specified in the inputs. Given the Android text interfaces, this makes the process difficult.

For example, input to MyContentProvider.query() might ask something like:

 SELECT column_a, column_b FROM my_table WHERE column_a=1 AND column_b=red; 

The problem is that in this case MyContentProvider _column_b_ may not make any sense and will not be present in the table. Filtering the projection so that only the corresponding columns remain can be easily done, since this is the string []. However, filtering the String " where " and " selectionArgs " inputs for these columns is not trivial. If everything is done correctly, it will be as follows:

 SELECT column_a FROM my_table WHERE column_a=1; 

Otherwise, you will get SQLiteException "no such column" .

So, is there an easy way to ignore or filter columns from such a sql statement, or do I need to go and write some intelligent, albeit very limited regex parsing code for the select part?

The reason I am not getting the correct input is because I support the custom ContentProvider as an interface for addressing, but I am talking to several custom ContentProvider here (in the background). Anyway, I will need to filter the selection somewhere.

Note that I am not asking to simply execute the query or use the SELECT ... WHERE . However, this applies to my implementation of the query() function.

Answer 1

Since you are extending your MyContentProvider with ContentProvider , why don't you overload the query() method?

See ContentProvider - Share Content Using ContentProvider for an example on how to create a custom ContentProvider. You should have full control over what data you retrieve from your SQLiteDatabase .

More importantly, look at the arguments to query() , as they contain the information you need so that you can dynamically build the query from what is passed into the method call.

Depending on whether you can find a good query builder, you may be able to create a small but powerful level of abstraction to create your queries so that you minimize the amount of actual SQL that you write yourself.

Also, always remember to sanitize your entries!