in reply to Re^2: CGI Action call
in thread CGI Action call
You are reading untrusted user input and use that to create an SQL statement. This is highly unsafe:
... my $searchterm = $query->param('searchterm'); ... my $stmt = "SELECT * FROM users WHERE $searchfield = $searchterm"; ... my $sth = $dbh->prepare ($stmt) or die "Error Preparing:\n" . $stmt . +"\nDBI returned: \n", $dbh->errstr; $sth->execute () or die "Unable to execute query: " . $sth->errstr +;
Please read DBI and learn about placeholders. You should never interpolate user input into SQL (or likely, any other kind of textual data).
You should rewrite your SQL statement and then use placeholders:
my $stmt = "SELECT * FROM users WHERE $searchfield = ?"; ... my $sth = $dbh->prepare ($stmt) or die "Error Preparing:\n" . $stm +t . "\nDBI returned: \n", $dbh->errstr; $sth->execute($searchterm) or die "Unable to execute query: " . $s +th->errstr;
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^4: CGI Action call
by tultalk (Monk) on Mar 12, 2018 at 20:14 UTC | |
Hi The "user"in this case is the administrator and logged on as such. That aside your point is well taken. I don't dee that placeholders would be needed below but can you use multiple place holders as in the below code?
I know there is better way through MySQL but not there yet | [reply] [d/l] |
by Corion (Patriarch) on Mar 12, 2018 at 20:25 UTC | |
Yes, as is documented in DBI. Also, your SQL seems faulty to me as the "previous record" seems to skip users:
This suggests that the "previous" entry for "Betty" (user id 4) is "Barney" (user id 2), and not user id 3 as I would expect. The same, but inverse holds for the other SQL. | [reply] [d/l] |
by tultalk (Monk) on Mar 27, 2018 at 17:00 UTC | |
I have a form with a navigator control I made. Works fine except when I want to scroll with a different order in place. The 4 SQL statements work fine in PHPAdmin. I issue an "alter table users order by lastname asc and the table is so ordered. Shows as such in browse. I execute the various SQL statements below and the returned records are as expected. next, next, previous, beginning and end. The ORDER remains in place. On the form I search for last name and set the alter table based on the search selected. This all works as intended per my logging. When I try to scroll the records with the navigator it is returning records based on the user_id order. I tried correcting this by reasserting the alter table again with each scroll but to no avail. Don't understand why the process works in PHP MyAdmin but not with my code.
More code
And yet more code
| [reply] [d/l] [select] |
by poj (Abbot) on Mar 27, 2018 at 20:31 UTC | |
by Corion (Patriarch) on Mar 27, 2018 at 17:05 UTC | |
by tultalk (Monk) on Mar 27, 2018 at 18:06 UTC | |
| |
by tultalk (Monk) on Mar 12, 2018 at 22:08 UTC | |
That may be. I threw it together and locked it to return related to fixed row number for testing other parts. Another to-do | [reply] |
by tultalk (Monk) on Mar 15, 2018 at 12:05 UTC | |
Need some insight. Have been staring at this since last night. Placeholder issue
placeholder substitution
This works fine with hard coded vaues instead of placeholders and also testing MySQL directly. count = 1 When running with the placeholders, count = 0 Result with hard code JSON output below
| [reply] [d/l] [select] |
by Corion (Patriarch) on Mar 15, 2018 at 12:22 UTC | |
by tultalk (Monk) on Mar 20, 2018 at 00:24 UTC | |
| |
|
Re^4: CGI Action call
by tultalk (Monk) on Mar 17, 2018 at 02:23 UTC | |
Speaking of placeholders. Playing around here. Just conceptualizing. Probably been done a million times before Can something sort of like this this work for automatically selecting the fields needing updating? Run a select * using user_id returning one record and load values into the $oldxxx variables then compare to the values submitted in the update query.
| [reply] [d/l] |
by poj (Abbot) on Mar 17, 2018 at 08:12 UTC | |
Use hash keys to avoid lots of variables. Push the field names, values onto arrays and use join to create the statement poj | [reply] [d/l] |
by Corion (Patriarch) on Mar 17, 2018 at 07:49 UTC | |
Yes you can do that. But to do that in a sensible way, please learn about the data structures that Perl offers and also read the DBI documentation. ->execute takes a list, not a comma-separated string. So, instead of building a comma-separated string, which still has the same interpolation problems, use an array to collect the changed fields. Also, it seems you are reinventing your own ORM. You might want to take a look at DBIx::Class or Class::DBI instead. | [reply] [d/l] |