Re^6: DBI do() SQL injection

Replies are listed 'Best First'.
Re^7: DBI do() SQL injection by choroba (Cardinal) on Oct 19, 2023 at 18:38 UTC
`#!/usr/bin/perl use warnings; use strict; use feature qw{ say }; use DBI; my $dbh = 'DBI'->connect('dbi:SQLite:dbname=:memory:', "", ""); my $id = q{42', 'Batman'); DROP TABLE customers; -- }; say qq('$id'); say $dbh->quote($id); __END__ Output: '42', 'Batman'); DROP TABLE customers; -- ' '42'', ''Batman''); DROP TABLE customers; -- '` [download] `map{substr$_->[0],$_->[1]\|\|0,1}[\\|\|{},3],[[]],[ref qr-1,-,-1],[{}],[sub{}^ARGV,3]`	[reply] [d/l] [select]

Replies are listed 'Best First'.

Re^7: DBI do() SQL injection
by choroba (Cardinal) on Oct 19, 2023 at 18:38 UTC

#!/usr/bin/perl
use warnings;
use strict;
use feature qw{ say };

use DBI;

my $dbh = 'DBI'->connect('dbi:SQLite:dbname=:memory:', "", "");
my $id =  q{42', 'Batman'); DROP TABLE customers; -- };
say qq('$id');
say $dbh->quote($id);

__END__
Output:
'42', 'Batman'); DROP TABLE customers; -- '
'42'', ''Batman''); DROP TABLE customers; -- '
[download]

map{substr$_->[0],$_->[1]||0,1}[\*||{},3],[[]],[ref qr-1,-,-1],[{}],[sub{}^*ARGV,3]

[reply]
[d/l]
[select]