Help for this page

Select Code to Download

Select or download this

my $q = CGI->new();
my $username = $q->param('user');
my $sql = "select * from users where username='$username'"; # BAD BAD 
+BAD

Select or download this

my $sql = "select * from users where username=?"; # GOOD
my $sth_user = $dbh->prepare_cached($sql)
    or die "can't prepare SQL:" . $dbh->errstr();
$sth_user->execute( $username );