Sql statement JavaScript

Question

I see the statement in executeSql like below:

addTodo: function (text) {
 app.db.transaction(function (tx) {
 var ts = new Date();
 tx.executeSql("INSERT INTO todo(todo, added_on) VALUES (?,?)", [text, ts], app.onSuccess, app.onError);
 });
 },

My question is: what does the " VALUES (?,?) " mean?

Answer 1

That's a prepared statement, which you should use to prevent SQL Injection attacks. E.g.

var text = "foo";
var ts = "bar";
tx.executeSql("INSERT INTO todo(todo, added_on) VALUES (?,?)", [text, ts]);

is the same as:

tx.executeSql("INSERT INTO todo(todo, added_on) VALUES ('foo','bar')");

Answer 2

Those are parameters that will be properly prepared and substituted by the array argument following the SQL statement.

So

tx.executeSql("INSERT INTO todo(todo, added_on) VALUES (?,?)", ['do this', '10/05/2014']);

will result in

INSERT INTO todo(todo, added_on) VALUES ('do this', '10/05/2014')