---
title: "Transactions and Injections in SQLite"  
description: "Transactions A database is transactional if it has all the changes and queries to be Atomic, Constant, Isolated and Durable (ACID). SQLite implements"  
author: "Prateek sharma"  
published: 2018-01-25  
updated: 2018-01-25  
canonical: https://www.mindstick.com/blog/11670/transactions-and-injections-in-sqlite  
category: "android apps"  
tags: ["android", "sqlite"]  
reading_time: 2 minutes  

---

# Transactions and Injections in SQLite

## [Transactions](https://www.mindstick.com/interview/864/explain-acid-rule-of-thumb-for-transactions)

A database is transactional if it has all the changes and queries to be Atomic, Constant, Isolated and Durable (ACID). SQLite implements [serializable](https://www.mindstick.com/interview/12756/what-is-difference-between-serializable-and-parcelable-which-is-best-approach-in-android) transactions even if it is interrupted by system crash or failures.

This means that in SQLite whatever transactions or changes occurred are atomic. In [SQLite database](https://www.mindstick.com/articles/1554/crud-operation-in-asp-dot-net-using-sqlite-database), the query or changes within a [single transaction](https://www.mindstick.com/interview/34322/how-would-you-ensure-atomicity-across-multiple-object-stores-in-a-single-transaction) occurs completely or not at all. Even if there is any interruption caused by the following –

- A power failure
- [Operating system](https://www.mindstick.com/articles/229069/operating-system-development) crashes down, or
- The program crash or failure.

\

## Injections

An injection is a way in which a user may run some SQL statements which runs unknowingly on the database. For example, suppose there is an [input field](https://www.mindstick.com/forum/158095/how-to-update-the-knockout-js-input-field-from-a-content-script-on-chrome-extension) which takes user’s name and a user inserts some SQL statements which runs unknowingly.

To stop these injections the [validation](https://www.mindstick.com/articles/12234/validation-using-data-annotation-using-entity-framework) of the fields must be done which can be done by [pattern matching](https://www.mindstick.com/articles/1865/pattern-matching-in-erlang). The following line of restricts the username to alphanumeric characters and underscores with the length between 8 and 20 characters.

\

```
if (preg_match("/^\w{8,20}$/", $_GET['username'], $matches)){
   $db = new SQLiteDatabase('filename');
   $result = @$db->query("SELECT * FROM users WHERE username = $matches[0]");
} else {
   echo "username not accepted";
}
```

There are various databases interfaces which do not permit query stacking or in easy language executing multiple queries in a single function call. If you try to stack queries, the call fails but SQLite perform stacked queries, executing all of the queries provided in one string and creating a serious security problem.

\

---

Original Source: https://www.mindstick.com/blog/11670/transactions-and-injections-in-sqlite

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.