FreeTDS Development Group

[Roger Burton West <roger AT firedrake.org>]

On Tue, Jan 02, 2001 at 11:51:49AM -0800, Michael Peppler wrote:
>mjn writes:
> > > my $sth = $dbh->prepare("SELECT * FROM authors WHERE state = 
> > > \"$state\"");
> > $state='"ca"';
>    $state = 'ca';
>    my $sth = $dbh->prepare("SELECT * FROM authors WHERE state = '$state'");
>or use the q() and qq() operators, like so:
>    my $sth = $dbh->prepare(qq(SELECT * FROM authors WHERE state = 
> "$state"));

But all of these are vulnerable to attacks which include whatever the
quoting character is - easily done if you're allowing outside input.
The DBI::quote function was designed specifically to get around this
problem, and will correctly quote _any_ string for use by the relevant
database.

$state='ca'; # or from other input

$state=$dbh->quote($state);
my $sth=$dbh->prepare("SELECT * FROM authors WHERE state = $state");

Roger