How to prevent “SQL Injection” in Core Data?

Question

I am building a pretty complex predicate in several iterations, and want to supply the matching values right away in the predicate.

Instead of:

[NSPr         


        

Answer 1

Use NSComparisonPredicate directly, and bypass the predicate format issues.

NSPredicate *fetchPredicate = [NSComparisonPredicate predicateWithLeftExpression:[NSExpression expressionForKeyPath:@"departmentName"]
                                                                 rightExpression:[NSExpression expressionForConstantValue:searchTerm]
                                                                        modifier:NSDirectPredicateModifier
                                                                            type:NSLikePredicateOperatorType
                                                                         options:0];

Have a read through the Predicate Programming Guide "Creating Predicates Directly in Code", and check the class reference for NSComparisonPredicate