mysql - Insert a value into SQL local database and print the tables data using Javascript -

i have form uses html , javascript submit data table of sql database. want submit typed user local sqlite database inside device. using phonegap can use html, javascript ans css. have data inserted value called submval . want insert value table called test , has 2 fields [id int not null-name varchar]. use code:

var db = window.opendatabase("database", "1.0", "cordova test", 20000); db.transaction(populatedb, errorcb, successcb);  function submitbutton() {     /*     code inserted data     */     var submval = submitteddata;     if (confirm('are sure want save ' + submval + ' database?')) {                  function populatedb(tx) {                  tx.executesql('insert test (id, name) values (1, submval)');                  }                  alert("succesfully inserted");     } else {                  alert("cancelled");     }  } 

so have 3 questions: 1. how submval second field of table? pretty sure 1 doesn't work:

tx.executesql('insert test (id, name) values (1, submval)'); 

2. how populatedb(tx) function working, physical continuation(not press other buttons or stuff). need change code this:

if (confirm('are sure want save ' + submval + ' database?')) {                      tx.executesql('insert test (id, name) values (1, submval)');} 

3. how can print every single line of table using function?

i made question bit more general in order many possible people have same problem. in advance.

basic javascript strings:

tx.executesql('insert test (id, name) values (1, submval)');                                                       ^^^^^^^ 

since submval inside string, javascript treats else inside string - text. means you're telling db engine insert value non-existent field.

you want

tx.executesql('insert test (id, name) values (1, ' + submval + ')');                                                       ^^^^^^^^^^^^^^^ 

so you're concatenating js variable sql string.

and note sort of construct leaves open sql injection attacks.

if submval non-numeric, it'll have quoted well.