taint has asked for the wisdom of the Perl Monks concerning the following question:

Greetings, Monks.

I see it's a bit quiet here today. So I thought I'd throw out a question that I've been meaning to get a difinative answer to, for a long time. But I should probably preface this, with the recognition that while I realize there's a myriad of possible scenarios, has anyone a formula they'd be willing to offer? Maybe this would be better as a Meditation, or become a tutorial?

OK. How does one determine the bast way to quote their data (string, or not)?

Perl offers so many choices:
q - singly quote a string
qq - doubly quote a string
qr - Compile pattern
quotemeta - quote regular expression magic characters
qw - quote a list of words
qx - backquote quote a string
and, of course; ' ' - single quotes
and " " - double quotes
heredocs - heredocs (thanks LanX for catching my omission)

In an effort to limit the scope, so as not to seem to vague, or unreasonable. I'd like to limit this question to situations that only deal with strings; input, and output -- especially as it relates to the web.

How do I know I've made the right, or safest choice? Can I simply just choose
print qq(yada,yada,yada);,
and know I'm fine? Or is
print '<input type="text" action="rm -rf /" />'; better?

perldoc(s) covers all the details of the quoting methods available. So I guess what I'm really asking, is; does anyone have a simple formula they use, that will always result in the perfect answer, in each/every situation?

Note; I probably would have chosen the Meditations section for this. But, as I noted earlier; it was quiet here today, and I thought others might benefit from the answers provided. But please kindly direct this to meditations, if you feel I'm wrong.

Best wishes, and thank you for your consideration.

--Chris

#!/usr/bin/perl -Tw
use Perl::Always or die;
my $perl_version = (5.12.5);
print $perl_version;
  • Comment on There are a million ways to quote. How can you determine the best/safest?

Replies are listed 'Best First'.
Re: There are a million ways to quote. How can you determine the best/safest?
by LanX (Saint) on Nov 16, 2013 at 21:08 UTC
    You forgot to mention heredocs! =)

    My (personal and improvised) formula is:

    • do you want variable interpolation?

      -> yes: " double $quote "

      -> no: ' single quote '

    • can it get complex (embedded quotes, some multiline, other language (e.g HTML) )?

      -> yes: use the according quote-like-operators (q or qq) with convenient q!delimiter!.

    • too complex to rule out embedded delimiters or too long to easily spot the end-delimiter?

      -> yes: use <<heredocs (i.e. multi-char-delimiter) or the <DATA>-section

    • varying sources, volatile, scalable, multiuser, no control whatsoever

      -> yes: use files or a DB and/or a template system

    qw is a special case of q which automatically splits on whitespaces.

    Regexes and system-calls are different beasts, but rules are similar, cause they operate on interpreted strings as input. (NB s/// and m// allow other delimiters, too!)

    quotemeta is very good if you can't control an "injected" string in an "interpreted" context like in a regex or with string-eval

    As you can see it's mainly a compromise between readability, maintainability and avoiding delimiter-problems.

    YMMV, readability is often a matter of taste.

    It also depends on number of collaborators, performance, scalability, the expected future of the project, and so on...

    Cheers Rolf

    ( addicted to the Perl Programming Language)

[reply]
[d/l]
[select]
      "You forgot to mention heredocs! =)"

      D'OH! You got me. Thanks for not penalizing me on that. I guess embarrassment could probably be considered punishment enough. :)
      I'll update the OP

      Thanks LanX. That's a good flow of logical deduction, ya got there.

      --Chris

      #!/usr/bin/perl -Tw
use Perl::Always or die;
my $perl_version = (5.12.5);
print $perl_version;
[reply]
Re: There are a million ways to quote. How can you determine the best/safest? (exaggeration)
by Anonymous Monk on Nov 17, 2013 at 02:36 UTC

    What is "best" and "safest"? You have a list, but it only inclues "names"; it doesn't explain what any of the quoting options do ; you can't make a decision (chooses "best" and "safest") if you don't know what the available options do

[reply]

Back to Seekers of Perl Wisdom