in reply to SQL in Perl and setting variables
What if the value of $XYZ is a single quote? Your SQL will no longer parse. You either have to escape the quotes in $XYZ, or use placeholders.
The efficiency issues mentioned above are true, but not worth worrying about right now. The gains from using placeholders are likely to be small. Chances are that the bottleneck on the program will be the DB updating itself, rather than the parsing.
As an aside, I despair of the flag of efficiency being raised at every opportunity, to the exclusion of correctness and safety. See A Tirade Against The Cult Of Performance .
xoxo,
Andy
--
<megaphone>
Throw down the gun and tiara and come out of the float!
</megaphone>
|
|---|