SQL

my $query; if ($ENV{REQUEST_METHOD} eq 'GET') { $query = $ENV{QUERY_STRING}; } elsif ($ENV{REQUEST_METHOD} eq 'POST') { read STDIN, $query, $ENV{CONTENT_LENGTH},0; } # make a hash from the query my %param; my @tupels = split /(\&|;)/,$query; for my $tupel(@tupels) { my ($key,$value) = split /=/, $tupel; $param{$key} = $value; } ##

##

CREATE TABLE persons (
    name varchar(255),
    age tinyint
);

##

##

#!/usr/bin/perl -T # always use -T for CGI stuff. read perlsec

use strict; use warnings;
use CGI qw(:standard); # this pulls in param(), header() and start_html()
use DBI;

my @query_results;
my $error;
my $name;
# if we have a 'name' param, check it...
if (param('name')) {
    if (param('name') =~ /^(\w+)$/) {
        $name = $1;
    }
    # ...and if name param is ok query the DB
    if ($name) {
        my $dbh = DBI->connect(
            "DBI:mysql:database=test",
            'testuser', # username - change to your setup
            'secretpw', # password - change to your setup
            {RaiseError => 1},
        ) or $error = "could not connect to database";
        my $sth = $dbh->prepare(
            "select name, age from persons where name = ?"
        );
        $sth->execute($name);
        while(my $row = $sth->fetchrow_arrayref) {
            push @query_results, $row;
        }
    }
} else {
    $error = "please enter a valid name\n";
}
print header(), start_html('SQL Query');
print <
SQL

SQL Query





EOH
foreach my $row (@query_results){
    my ($name, $age) = @$row;
    print "\n";
}
print "\n
Name Age
$name $age\n";
print "$error" if $error;
print "\n";