in reply to Returning values from mysql with cgi
My previous answer showed you how to do interpolation, and more importantly, how to avoid interpolation by using placeholders. You're still doing interpolation wrong, and more importantly, still not using placeholders.
These lines:
my $sth = $dbh->prepare('Select * from users where name = "$name"'); $sth->execute();
Are still wrong, for two reasons. First, because single quotes don't do variable interpolation, even if you embed double quotes within them:
my $var = "Hello"; my $other = '$var world'; # Wrong. my $outro = '"$var" world'; # Still wrong. my $right = "$var world"; # Correct.
This is documented briefly in perlintro: Basic Syntax Overview, and in more detail in perlop.
But you don't need interpolation, and shouldn't even be using it, because it's error-prone at best, and unsafe at worst when using it to construct queries. Instead, use placeholders. I showed you how in my previous answer, but your code changed slightly, so I'll demonstrate again, this time in consideration of the modified code:
my $sth = $dbh->prepare( 'SELECT * FROM users WHERE name = ?' ); $sth->execute( $name );
I referred you earlier to the documentation for DBI. This time I'll link to the exact section within that document where you should focus your reading:
Dave
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^2: Returning values from mysql with cgi
by Chaotic Jarod (Novice) on Jul 18, 2013 at 13:26 UTC |