> writefile() only has two arguments according to the above page.
That's just an example. The documentation continues:
> Note that the readfile(X) and writefile(X,Y) functions are extension functions and are not built into the core SQLite library. These routines are available as a loadable extension in the ext/misc/fileio.c source file in the SQLite source code repositories.
Clicking on the `fileio.c` link gives you the source code with the full documentation of the `writefile()` function. Figuring out what those last two arguments do is a simple exercise for the reader.
> where `dirOnly` and `dir` are defined
In [`arExtractCommand()`](https://www.sqlite.org/src/info?name=586493be0d3a2fc1e6803577d683697dfefc0fb305cc966bb389ce4045cbc19d&ln=6381-6451). `dir` would appear to be the directory specified as the argument to the `-C` option I mentioned before (default: `""`), while `dirOnly` is set to `0` and `1` successively, to first select the files in the archive, then the directories.
> Why does the same select command appear twice below?
From the source:
```
/* Run the SELECT statement twice. The first time, writefile() is called
** for all archive members that should be extracted. The second time,
** only for the directories. This is because the timestamps for
** extracted directories must be reset after they are populated (as
** populating them changes the timestamp). */
```
> What does `name NOT GLOB '*..[/\]*'` mean?
I'm pretty sure it's a cheap way to weed out directory traversal attacks like `../../../../../../../etc/passwd`.