FreeTDS Development Group

[mjn <mjn AT umn.edu>]

> On Tue, Jan 02, 2001 at 11:51:49AM -0800, Michael Peppler wrote:
> >mjn writes:
> > > > my $sth = $dbh->prepare("SELECT * FROM authors WHERE state = 
> > > > \"$state\"");
> > > $state='"ca"';
> >    $state = 'ca';
> >    my $sth = $dbh->prepare("SELECT * FROM authors WHERE state = 
> > '$state'");
> >or use the q() and qq() operators, like so:
> >    my $sth = $dbh->prepare(qq(SELECT * FROM authors WHERE state = 
> > "$state"));
> 
> But all of these are vulnerable to attacks which include whatever the
> quoting character is - easily done if you're allowing outside input.
> The DBI::quote function was designed specifically to get around this
> problem, and will correctly quote _any_ string for use by the relevant
> database.
>
> $state=$dbh->quote($state);
> my $sth=$dbh->prepare("SELECT * FROM authors WHERE state = $state");

So what about using:

@configuration = qw(value1 value2 value3)

to pass information?  Is this unsafe like the rest of the instances we
have mentioned?

____________________________
Mike Neuharth
ADCS Technology Specialist
http://www.umn.edu/adcs

E-Mail          : mjn AT umn.edu
Page Mail       : 6126486512 AT page.metrocall.com
http://nifty.dsl.visi.com/
____________________________