求注释memcpy和strcat函数都是什么意思？

zyx19891210

1.    sql="select * from fileinfo where fileName='";
   
2.      memcpy(str,sql,strlen(sql)+1) ;
   
3.      strcat(str,argv[2]);
   
4.      strcat(str,"'");
   
5.      sqlite3_get_table( db , str , &azResult , &nrow , &ncolumn , 0 );
   
6.       if(nrow>0){

复制代码

请问这里的两个函数是什么意思？
求标一下注释并解释一下

_Rayx

这是程序员么？

bruceteen

2楼说得对

sprintf( str, "select * from fileinfo where fileName='%s'", argv[2] );

hellioncu

这代码写得比较烂

folklore

回复 3# bruceteen


    sprintf( str, "select * from fileinfo where fileName='%s'", Addslash(argv[2]));   //Addslash to prevent sql inject..

bruceteen

回复 5# folklore
我不搞SQL，但我觉得要想防止sql注入，就应该禁止掉SQL
SQL这种描述性的语句怎么敢作为远程接口

folklore

回复 6# bruceteen


    how to?
i think it is impossible to prohabit to use sql in the programs that interoperating with database.
or you can give better solution to do that.

the only thing that we can do is check the input to prevent the sql injection.
does it?

幻の上帝

回复 7# folklore

prohabit...prohibit?

There exists database system without SQL.

haitao

memcpy复制内存块
strcat追加字符串
例子的memcpy用法，也正好相当于sprintf
更简单高效的，应该：str[0]=0; strcat(str,sql);