Dear Monks.

I am in the process of an sql parameterization project and would like some clarity on a few finer points.

Relating to "LIKE ?" is this the best practice:

@input                = ();

$string = "abc";

push(@input, '%' . $string . '%');

$sth=$dbh->prepare("SELECT *
                    FROM table
                    WHERE field LIKE ?") or die $dbh->errstr;
$sth->execute(@input) or die $dbh->errstr;
[download]

What is the best way to use in():

@input                = ();

$string = "1,2,3";

push(@input, $string);

$sth=$dbh->prepare(" SELECT *
                    FROM table
                    WHERE field IN (?) ") or die $dbh->errstr;
$sth->execute(@input) or die $dbh->errstr;
[download]

Thank You. 🙏