How do I escape data in Javascript for a client-side database like WebDB or Google Gears? -

if i'm using client-side database google gears or webdb implementation, what's best way escape data prevent sql injection? wrap in encodeuri()?

furthermore, need worry it? there's blurb here, http://code.google.com/apis/gears/api_database.html#database-execute makes me think it's handled me, wasn't sure.

you don't have worry quoting/escaping if you're using placeholders. this:

resultset = db.execute (   'insert mytable values (?, ?, ?) id=?',   [some, variables, that_you_got_from, somewhere] ) 

is fine as-is. if you're trying build sql pasting bunch of strings you're going have problems don't that. however, there cases you'll need paste strings sql there safe ways around that; tends common case can use both placeholders , string concatenation:

var list = some_array_of_unknown_size_and_origin; var qs   = [ ];  for(var = 0; < list.size; ++i)      qs.push('?');  var rs = db.execute(     'update some_table set col = 'blahblah' id in (' + qs.join(',') + ')',     list );