Skip to Content.
Sympa Menu

freetds - Re: 4.2 limitation...

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: mjn <mjn AT umn.edu>
  • To: TDS Development Group <freetds AT franklin.oit.unc.edu>
  • Subject: Re: 4.2 limitation...
  • Date: Thu, 4 Jan 2001 15:19:42 -0600 (CST)


> On Tue, Jan 02, 2001 at 11:51:49AM -0800, Michael Peppler wrote:
> >mjn writes:
> > > > my $sth = $dbh->prepare("SELECT * FROM authors WHERE state =
> > > > \"$state\"");
> > > $state='"ca"';
> > $state = 'ca';
> > my $sth = $dbh->prepare("SELECT * FROM authors WHERE state =
> > '$state'");
> >or use the q() and qq() operators, like so:
> > my $sth = $dbh->prepare(qq(SELECT * FROM authors WHERE state =
> > "$state"));
>
> But all of these are vulnerable to attacks which include whatever the
> quoting character is - easily done if you're allowing outside input.
> The DBI::quote function was designed specifically to get around this
> problem, and will correctly quote _any_ string for use by the relevant
> database.
>
> $state=$dbh->quote($state);
> my $sth=$dbh->prepare("SELECT * FROM authors WHERE state = $state");

So what about using:

@configuration = qw(value1 value2 value3)

to pass information? Is this unsafe like the rest of the instances we
have mentioned?

____________________________
Mike Neuharth
ADCS Technology Specialist
http://www.umn.edu/adcs

E-Mail : mjn AT umn.edu
Page Mail : 6126486512 AT page.metrocall.com
http://nifty.dsl.visi.com/
____________________________






Archive powered by MHonArc 2.6.24.

Top of Page