DbPrepareString
dbPrepareString
Builds a safely escaped SQL string from placeholders without executing it.
Syntax
string dbPrepareString(DatabaseConnection connection, string statement, ...)
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
connection |
DatabaseConnection |
yes | The connection whose escaping rules are used. |
statement |
string |
yes | SQL with ? value or ?? identifier placeholders.
|
... |
nil/bool/number/string |
no | Values or identifiers inserted into the placeholders. |
Returns
Returns the prepared SQL string, or false when preparation fails.
Examples
Prepare a diagnostic query with a safe identifier:
local sql = dbPrepareString(db,
"SELECT ?? FROM players WHERE id = ?",
"level",
playerId
)
print(sql)
Notes
- Available only in server-side resource scripts.
- Use
?for values and??only for identifiers such as column names.