4.2 limitation...
Roger Burton West
roger at firedrake.org
Tue Jan 2 16:36:10 EST 2001
On Tue, Jan 02, 2001 at 11:51:49AM -0800, Michael Peppler wrote:
>mjn writes:
> > > my $sth = $dbh->prepare("SELECT * FROM authors WHERE state = \"$state\"");
> > $state='"ca"';
> $state = 'ca';
> my $sth = $dbh->prepare("SELECT * FROM authors WHERE state = '$state'");
>or use the q() and qq() operators, like so:
> my $sth = $dbh->prepare(qq(SELECT * FROM authors WHERE state = "$state"));
But all of these are vulnerable to attacks which include whatever the
quoting character is - easily done if you're allowing outside input.
The DBI::quote function was designed specifically to get around this
problem, and will correctly quote _any_ string for use by the relevant
database.
$state='ca'; # or from other input
$state=$dbh->quote($state);
my $sth=$dbh->prepare("SELECT * FROM authors WHERE state = $state");
Roger
More information about the FreeTDS
mailing list