DbPrepareString

dbPrepareString

Builds a safely escaped SQL string from placeholders without executing it.

Syntax

string dbPrepareString(DatabaseConnection connection, string statement, ...)

Parameters

Name	Type	Required	Description
connection	DatabaseConnection	yes	The connection whose escaping rules are used.
statement	string	yes	SQL with ? value or ?? identifier placeholders.
...	nil/bool/number/string	no	Values or identifiers inserted into the placeholders.

Returns

Returns the prepared SQL string, or false when preparation fails.

Examples

Prepare a diagnostic query with a safe identifier:

local sql = dbPrepareString(db,
    "SELECT ?? FROM players WHERE id = ?",
    "level",
    playerId
)
print(sql)

Notes

• Available only in server-side resource scripts.
• Use ? for values and ?? only for identifiers such as column names.