string variable in C++ to be used qith odbc sql insert

Hello everyone,
im trying to use an sql insert into a C++ application but unfortunately i cant input the values of the string variables to the tables!
below is an example of my insert statement, the same statement works fine with integers, etc but not with string variables!

Code:

---

sprintf((char*)SQLStmt,"INSERT INTO teststr(thestr) VALUES ('%s');",str);
if(SQL_SUCCESS!=SQLExecDirect(sqlstatementhandle,SQLStmt, SQL_NTS)){
    show_error(SQL_HANDLE_STMT, sqlstatementhandle); 

    }

---

can you help please?
thanx

Try

Code:

---

sprintf((char*)SQLStmt,"INSERT INTO teststr(thestr) VALUES ('%s');",str.c_str());

---

Kurt

You should be using Prepared Statements to prevent SQL Injection attacks.

Quote:

---

Originally Posted by ZuK

Try

Code:

---

sprintf((char*)SQLStmt,"INSERT INTO teststr(thestr) VALUES ('%s');",str.c_str());

---

Kurt

---

the str variable it is a string. ex. string str="hello";

Quote:

---

Originally Posted by ZuK

Try

Code:

---

sprintf((char*)SQLStmt,"INSERT INTO teststr(thestr) VALUES ('%s');",str.c_str());

---

Kurt

---

I made some changes to the RETCODE variable and it worked. But it had a problem and it wasnt able to insert the proper characters of a string variable. After i added '.c_str()', everything was just fine! Thanx Kurt.