4.2 limitation...

Michael Peppler mpeppler at peppler.org
Tue Jan 2 16:45:36 EST 2001


Roger Burton West writes:
 > On Tue, Jan 02, 2001 at 11:51:49AM -0800, Michael Peppler wrote:
 > >mjn writes:
 > > > > my $sth = $dbh->prepare("SELECT * FROM authors WHERE state = \"$state\"");
 > > > $state='"ca"';
 > >    $state = 'ca';
 > >    my $sth = $dbh->prepare("SELECT * FROM authors WHERE state = '$state'");
 > >or use the q() and qq() operators, like so:
 > >    my $sth = $dbh->prepare(qq(SELECT * FROM authors WHERE state = "$state"));
 > 
 > But all of these are vulnerable to attacks which include whatever the
 > quoting character is - easily done if you're allowing outside input.
 > The DBI::quote function was designed specifically to get around this
 > problem, and will correctly quote _any_ string for use by the relevant
 > database.

Agreed - and I actually have an article in the current ISUG Tech
Journal on this issue :-)

Michael
-- 
Michael Peppler - Data Migrations Inc. - mpeppler at peppler.org
http://www.mbay.net/~mpeppler - mpeppler at mbay.net - AIM MPpplr
International Sybase User Group - http://www.isug.com
Sybase on Linux mailing list: ase-linux-list at isug.com



More information about the FreeTDS mailing list