4.2 limitation...
mjn
mjn at umn.edu
Thu Jan 4 16:19:42 EST 2001
> On Tue, Jan 02, 2001 at 11:51:49AM -0800, Michael Peppler wrote:
> >mjn writes:
> > > > my $sth = $dbh->prepare("SELECT * FROM authors WHERE state = \"$state\"");
> > > $state='"ca"';
> > $state = 'ca';
> > my $sth = $dbh->prepare("SELECT * FROM authors WHERE state = '$state'");
> >or use the q() and qq() operators, like so:
> > my $sth = $dbh->prepare(qq(SELECT * FROM authors WHERE state = "$state"));
>
> But all of these are vulnerable to attacks which include whatever the
> quoting character is - easily done if you're allowing outside input.
> The DBI::quote function was designed specifically to get around this
> problem, and will correctly quote _any_ string for use by the relevant
> database.
>
> $state=$dbh->quote($state);
> my $sth=$dbh->prepare("SELECT * FROM authors WHERE state = $state");
So what about using:
@configuration = qw(value1 value2 value3)
to pass information? Is this unsafe like the rest of the instances we
have mentioned?
____________________________
Mike Neuharth
ADCS Technology Specialist
http://www.umn.edu/adcs
E-Mail : mjn at umn.edu
Page Mail : 6126486512 at page.metrocall.com
http://nifty.dsl.visi.com/
____________________________
More information about the FreeTDS
mailing list