Android StudioのSQLite構文エラー

Question

私はアプリを作成しています。私はこのエラーを取得するときに私のアプリがクラッシュ：

package com.harshit.csdp; 

import android.content.Context; 
import android.content.Intent; 
import android.database.Cursor; 
import android.database.sqlite.SQLiteDatabase; 
import android.graphics.Typeface; 
import android.support.design.widget.TextInputLayout; 
import android.support.v7.app.AppCompatActivity; 
import android.os.Bundle; 
import android.view.View; 
import android.widget.*; 

public class LoginActivity extends AppCompatActivity { 
    private EditText kiitmail, pass; 
    private Spinner spn; 
    private TextInputLayout inputKiitMail; 
    SQLiteDatabase sqldb; 
    Button register, login; 
    @Override 
    protected void onCreate(Bundle savedInstanceState) { 
     super.onCreate(savedInstanceState); 
     setContentView(R.layout.login); 
     sqldb = openOrCreateDatabase("xyza", Context.MODE_PRIVATE,null); 
     final String adminEmail = "admin@kiit.ac.in"; 
     final String adminPass = "admin123"; 
     final String adminStatus = "Administrator" ; 



     boolean firstRun = getSharedPreferences("preferences", MODE_PRIVATE).getBoolean("firstRun", true); 
     if(firstRun){ 
      getSharedPreferences("preferences", MODE_PRIVATE).edit().putBoolean("firstRun", false).commit(); 
      Toast.makeText(getApplicationContext(),"First Run Detected.\nDatabase, tables and Administrator account created.",Toast.LENGTH_LONG).show(); 
      sqldb.execSQL("Create table LoginMaster(UserID varchar, Password varchar,Status varchar)"); 
      sqldb.execSQL("insert into LoginMaster values('"+adminEmail+"','"+adminPass+"','"+adminStatus+"')"); 

      sqldb.execSQL("Create table StudentMaster(UserID varchar, RollNo varchar,Batch varchar, Branch varchar, Degree varchar, JoiningYear varchar)"); 
      sqldb.execSQL("Create table FacultyMaster(UserID varchar, Degree varchar, JoiningYear varchar)"); 
      sqldb.execSQL("Create table StudentPersonalMaster(UserID varchar, Name varchar, DOB varchar, Gender varchar, Address varchar, MobNumber varchar)"); 
      sqldb.execSQL("Create table FacultyPersonalMaster(UserID varchar, Name varchar, DOB varchar, Gender varchar, MobNumber varchar)"); 
      sqldb.execSQL("Create table StudentAcademicMaster(UserID varchar, AcademicAchievement varchar,Sports varchar, Cultural varchar, Others varchar, HighSchool varchar)"); 
      sqldb.execSQL("Create table StudentTechnicalMaster(UserID varchar, PLanguage varchar,Database varchar, OS varchar, Software varchar, OtherSkill varchar, IndustryExperience varchar, AcademicProject varchar)"); 
      sqldb.execSQL("Create table NoticeMaster(UserID varchar, Title varchar,Content varchar, Type varchar, Date varchar)"); 
     } 

     kiitmail = (EditText)findViewById(R.id.editText1); 
     pass = (EditText)findViewById(R.id.editText2); 
     spn = (Spinner)findViewById(R.id.spinner1); 
     login = (Button)findViewById(R.id.button1); 



     login.setOnClickListener(new View.OnClickListener() { 
      @Override 
      public void onClick(View v) { 
       if(spn.getSelectedItem().toString().equals(adminStatus)){ 
        Intent intent = new Intent(getApplicationContext(),AdminPage.class); 
        startActivity(intent); 
       } 
       else if(verifyLogin()&&spn.getSelectedItem().toString().equals("Student")){ 
        String km = kiitmail.getText().toString(); 
        Intent studentPage = new Intent(LoginActivity.this, StudentPage.class); 
        studentPage.putExtra("uid",km); 
        startActivity(studentPage); 
       } 
       else{ 
        Toast.makeText(getApplicationContext(),"Fuck you",Toast.LENGTH_LONG).show(); 
       } 

      } 
     }); 


     Typeface font = Typeface.createFromAsset(getAssets(), "fontawesome.ttf"); 
     TextView textView7 = (TextView)findViewById(R.id.textView7); 
     TextView textView8 = (TextView)findViewById(R.id.textView8); 
     textView7.setTypeface(font); 
     textView8.setTypeface(font); 

     register = (Button)findViewById(R.id.button2); 
     register.setOnClickListener(new View.OnClickListener() { 
      @Override 
      public void onClick(View v) { 
       Intent i = new Intent(getApplicationContext(),InitialRegistrationActivity.class); 
       startActivity(i); 
      } 
     }); 


    } 
    public boolean verifyLogin(){ 
     String checkMailID = kiitmail.getText().toString(); 
     String checkPassword = pass.getText().toString(); 
     Cursor cursor = sqldb.rawQuery("Select * from LoginMaster where UserID = "+checkMailID+" and Password = "+checkPassword+";", null); 
     if(cursor.getCount() <= 0){ 
      cursor.close(); 
      return false; 
     } 
     cursor.close(); 
     return true; 
    } 
} 

方法：私はエラーを取得するとき、私はすでに成功し、テーブルに挿入されているUserIDとPasswordが、それはだ入力

android.database.sqlite.SQLiteException: near "@kiit": syntax error (code 1): , while compiling: Select * from LoginMaster where UserID = 1505293@kiit.ac.in and Password = harshit999;

このエラーを修正しますか？助言がありますか？

Answer 1

はあなたのクエリこの方法を実行します。

Cursor cursor = sqldb.rawQuery("Select * from LoginMaster where UserID = \""+checkMailID+"\" and Password = \""+checkPassword+"\";", null); 

あなたのクエリパラメータを引用しなければなりません。さらに、あなたのコードはSQLインジェクションのために脆弱です。生のクエリが、クエリAPIを使用しないでください：あなたが欠落している可能性がありますように見えますSQLite