in reply to DBI do() SQL injection

Of course you can use placeholders with do(). What makes you think otherwise?

🦛

Replies are listed 'Best First'.
Re^2: DBI do() SQL injection
by Anonymous Monk on Oct 19, 2023 at 12:34 UTC
    what?? can you give an example of that?
[reply]

      Of course I can - here's the one from the documentation:

      my $rows_deleted = $dbh->do(q{
    DELETE FROM table
    WHERE status = ?
}, undef, 'DONE') or die $dbh->errstr;

      [download]

      It is always beneficial to read the documentation.

      🦛

[reply]
[d/l]
        doh...thanks! In all the other occasions like 
        $dbh->do(qq{ 
insert into customers
(id,name)
values('$id','$name')}
)

        [download]
        can you get injected?
[reply]
[d/l]

In Section Seekers of Perl Wisdom