Generate SQL query from NSDictionary - sql

Question

I would like to generate SQL statement from my Dictionary object. Because i have to eliminate the update process of empty string in corresponding column. i can do this via Swift code but doing this repeat action not good. is there any way to do this via SQL Statement?.
i have found some link on StackOverflow.
Asp.net link
and MySQL StackOverflow link
like sample example in python code
def insertFromDict(table, dict):
"""Take dictionary object dict and produce sql for
inserting it into the named table"""
sql = 'INSERT INTO ' + table
sql += ' ('
sql += ', '.join(dict)
sql += ') VALUES ('
sql += ', '.join(map(dictValuePad, dict))
sql += ');'
return sql
def dictValuePad(key):
return '%(' + str(key) + ')s'

Answer 1

let r = sqlFrom(dict: ["name" : "String", "type" : "sort"], for: "MyTable")
print(r)
Needed function:
func sqlFrom(dict : [String : String], for table : String) -> String {
let keys = dict.keys.joined(separator: ", ")
var values = dict.values.joined(separator: "', '")
values = """
'\(values)'
"""
let sql = "INSERT INTO \(table) ( \(keys) ) VALUES ( \( values) );"
return sql
}
Check result here:

Answer 2

Following method will do the job, but will not prevent you from sql injections
func insertStatement(table: String, dict: [String : Any]) -> String {
let values: [String] = dict.values.compactMap { value in
if value is String || value is Int || value is Double {
return "'\(value)'"
} else if let date = value as? Date {
let dateFormatter = DateFormatter()
dateFormatter.dateFormat = "yyyy-MM-dd"
return "'" + dateFormatter.string(from: date) + "'"
}
// handle other types if necessary
return nil
}
return "INSERT INTO \(table) (" + dict.keys.joined(separator: ",") + ") VALUES (" + values.joined(separator: ",") + ")"
}
Usage:
insertStatement(table: "test_table", dict: ["id": 8, "name" : "John", "age" : Date()])
Output: INSERT INTO test_table(id,age,name) VALUES ('8','2019-04-24','John')
To prevent from SQL injections you have to use prepared statements to bind values, such as in the PHP's PDO library, like so:
func insertStatement(table: String, dict: [String : Any]) {
let columns = dict.keys.joined(separator: ",")
let values = dict.keys.map({ ":" + $0 }).joined(separator: ",")
// build the statement
let sql = "INSERT INTO " + table + "(" + columns + ") VALUES (" + values + ")"
var bind: [String : Any] = [:]
for (column, value) in dict {
bind[":\(column)"] = value
}
}