SQLite insert into table -> Parameter count mismatch

[ChrisW67]

Parameterization looks odd to me. Is there an advantage doing this or is this just a personal style thing?

It has the advantage that you do not have to worry about quoting values, the query is easier to read and validate, and it is clear what values are inserted into the query. The first point has substantial security advantages in the face of user-input. Consider this example:

QString qry = "UPDATE passwordTable SET password ='" + newPassword + "' WHERE userName = '" + userInput +"' ";

QString qry = "UPDATE passwordTable SET password ='" + newPassword + "' WHERE userName = '" + userInput +"' ";

To copy to clipboard, switch view to plain text mode 

when the malicious user has provided this as userInput:

dummy' OR 'x' = 'x

dummy' OR 'x' = 'x

To copy to clipboard, switch view to plain text mode 

the query becomes:

UPDATE passwordTable SET password ='opensesame' WHERE userName = 'dummy' OR 'x' = 'x'

UPDATE passwordTable SET password ='opensesame' WHERE userName = 'dummy' OR 'x' = 'x'

To copy to clipboard, switch view to plain text mode 

which is obviously a bad thing. Using parameters avoids this possibility.