title: Running parameterized queries in QSqlTableModel
body: <p>I have a <code>QTableView</code> and I am using a derived class <code>SqlTableModel</code> of <code>QSqlTableModel</code> to fetch data from a MySQL database. I want to prevent injection. I ran a union injection and it was easier than taking candy from a baby. The SQL query utilizes the LIKE keyword.</p>
  <h4>Attempt 1 (injectable):</h4>
  <pre class="lang-cpp prettyprint-override"><code>QString query = QString(&quot;select * from table where col like '%%1%'&quot;).arg(edit-&gt;text());
  QSqlQuery q(query);
  SqlTableModel *model = new SqlTableModel();
  model-&gt;setQuery(q);
  model-&gt;select();
  tableView-&gt;setModel(model);
  </code></pre>
  <h4>Attempt 2 (no data is returned, no errors):</h4>
  <pre class="lang-cpp prettyprint-override"><code>QString query = &quot;select * from table&quot;;
  QSqlQuery q(query);
  SqlTableModel *model = new SqlTableModel();
  model-&gt;setQuery(q);
  model-&gt;setFilter(QString(&quot;col like '%%1%'&quot;).arg(edit-&gt;text()));
  model-&gt;select();
  tableView-&gt;setModel(model);
  </code></pre>
  <h4>Attempt 3 (no data is returned, no errors):</h4>
  <pre class="lang-cpp prettyprint-override"><code>QString query = &quot;select * from table where col like :param&quot;;
  QSqlQuery q(query);
  q.prepare(query);
  q.bindValue(&quot;:param&quot;, QString(&quot;%%1%&quot;).arg(edit-&gt;text()));
  SqlTableModel *model = new SqlTableModel();
  model-&gt;setQuery(q);
  model-&gt;select();
  tableView-&gt;setModel(model);
  </code></pre>