SQLStore - use compiled sql statements, use update for merge

[BenSchwab]

closes #369

[digitalbuddha]

I'm terrible with sql stuff. Didn't you just remove the compile statement stuff?

[BenSchwab]

Haha me too -- it's pretty arcane stuff. I changed the compile statement to use the insert / update methods outlined here: https://developer.android.com/training/basics/data-storage/databases.html.

I think the advantage is that those methods will properly cleanse the arguments for sql injection attacks.

With the compile sql using a string, I think a user could construct a malicious record key that performs sql injection.

[digitalbuddha]

Make sense thanks for explaining! I just assumed CompiledStatements == PreparedStatements.

[digitalbuddha]

I remembered again why I use sqlDelight :-)

[BenSchwab]

I think there is a difference between what I changed this too, and compiled statements. And compile statements have performance benefits. I'll go ahead and land this so SQLStore is functional, but I'll continue thinking about the optimal structure.

And yeah sqlDelight might be nice :)