diva_sqli

//code awal

public void search(View view) {
        EditText srchtxt = (EditText) findViewById(R.id.ivi1search);
        Cursor cr = null;
        try {
            cr = mDB.rawQuery("SELECT * FROM sqliuser WHERE user = '" + srchtxt.getText().toString() + "'", null);

//replace ' to nothing
public void search(View view) {
        EditText srchtxt = (EditText) findViewById(R.id.ivi1search);
        Cursor cr = null;
        try {
            String myStr = srchtxt.getText().toString();
            cr = mDB.rawQuery("SELECT * FROM sqliuser WHERE user = '" + myStr.replace('\'', '') + "'", null); //replace / hilangkan '