Skip to Content.
Sympa Menu

freetds - Re: 4.2 limitation...

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Roger Burton West <roger AT firedrake.org>
  • To: TDS Development Group <freetds AT franklin.oit.unc.edu>
  • Subject: Re: 4.2 limitation...
  • Date: Tue, 2 Jan 2001 21:36:10 +0000


On Tue, Jan 02, 2001 at 11:51:49AM -0800, Michael Peppler wrote:
>mjn writes:
> > > my $sth = $dbh->prepare("SELECT * FROM authors WHERE state =
> > > \"$state\"");
> > $state='"ca"';
> $state = 'ca';
> my $sth = $dbh->prepare("SELECT * FROM authors WHERE state = '$state'");
>or use the q() and qq() operators, like so:
> my $sth = $dbh->prepare(qq(SELECT * FROM authors WHERE state =
> "$state"));

But all of these are vulnerable to attacks which include whatever the
quoting character is - easily done if you're allowing outside input.
The DBI::quote function was designed specifically to get around this
problem, and will correctly quote _any_ string for use by the relevant
database.

$state='ca'; # or from other input

$state=$dbh->quote($state);
my $sth=$dbh->prepare("SELECT * FROM authors WHERE state = $state");

Roger




Archive powered by MHonArc 2.6.24.

Top of Page