dnamonk:
If you're not using placeholders for your database code, then perhaps you've got a field with an embedded apostrophe in it. For example:
my $t = "Bobby Tables' and HeadName=1; drop table mytable;";
my $SQL = "select * from mytable where id='$t'";
print $SQL, "\n";
If you expand the resulting SQL and reformat it, you'll see that it's rather fortunate that HeadName isn't a column in your table!
select * from mytable
where id='Bobby Tables'
and HeadName=1;
drop table mytable;
...roboticus
When your only tool is a hammer, all problems look like your thumb. |