system.db.runPrepUpdate

Runs a prepared statement against the database, returning the number of rows that were affected. Prepared statements differ from regular queries in that they can use a special placeholder, the question-mark character (?) in the query where any dynamic arguments would go, and then use an array of values to provide real information for those arguments. Make sure that the length of your argument array matches the number of question-mark placeholders in your query. This call should be used for UPDATE, INSERT, and DELETE queries.

This method avoids the problematic technique of concatenating user input inside of a query, which can lead to syntax errors, or worse, a nasty security problem called a SQL injection attack. For example, if you have a user-supplied string that is used in a WHERE clause, you use single-quotes to enclose the string to make the query valid. What happens in the user has a single-quote in their text? Your query will fail. Prepared statements are immune to this problem.

2.	This is the only way to write an INSERT or UPDATE query that has binary or BLOB data. Using BLOBs can be very hand for storing images or reports in the database, where all clients have access to them.

String query - A query (typically an UPDATE, INSERT, or DELETE) to run as a prepared statement with placeholders (?) denoting where the arguments go.

Object[] args - A list of arguments. Will be used in order to match each placeholder (?) found in the query.

String database - The name of the database connection to execute against. If omitted or "", the project's default database connection will be used.

String tx - A transaction identifier. If omitted, the update will be executed in its own transaction.

Boolean getKey - A flag indicating whether or not the result should be the number of rows returned (getKey=0) or the newly generated key value that was created as a result of the update (getKey=1). Not all databases support automatic retrieval of generated keys.

Boolean skipAudit - A flag which, if set to true, will cause the prep update to skip the audit system. Useful for some queries that have fields which won't fit into the audit log.

Integer - The number of rows affected by the query, or the key value that was generated, depending on the value of the getKey flag.

This example would gather some user entered text and insert it into the database.

userText = event.source.parent.getComponent("TextArea").text
userName = system.security.getUsername()
system.db.runPrepUpdate("INSERT INTO Comments (Name, UserComment) "

filename = system.file.openFile() # Ask the user to open a file
if filename != None:
filedata = system.file.readFileAsBytes(filename)
system.db.runPrepUpdate("INSERT INTO Files (file_data) VALUES (?)", [filedata])

This example inserts a new user and gives it the 'admin' role. Demonstrates the ability to retrieve a newly created key value.

id = system.db.runPrepUpdate("INSERT INTO machines (machine_name, description) "