4.2 limitation...

Roger Burton West roger at firedrake.org
Tue Jan 2 16:36:10 EST 2001


On Tue, Jan 02, 2001 at 11:51:49AM -0800, Michael Peppler wrote:
>mjn writes:
> > > my $sth = $dbh->prepare("SELECT * FROM authors WHERE state = \"$state\"");
> > $state='"ca"';
>    $state = 'ca';
>    my $sth = $dbh->prepare("SELECT * FROM authors WHERE state = '$state'");
>or use the q() and qq() operators, like so:
>    my $sth = $dbh->prepare(qq(SELECT * FROM authors WHERE state = "$state"));

But all of these are vulnerable to attacks which include whatever the
quoting character is - easily done if you're allowing outside input.
The DBI::quote function was designed specifically to get around this
problem, and will correctly quote _any_ string for use by the relevant
database.

$state='ca'; # or from other input

$state=$dbh->quote($state);
my $sth=$dbh->prepare("SELECT * FROM authors WHERE state = $state");

Roger



More information about the FreeTDS mailing list