in reply to Using OR in SELECT statments safely

You might build a query string with placeholders:

my @items = qw(ABC1 EFG2 IJK3); my $cond = join ' OR ', ('item_id = ?') x scalar @items; $dbh->selectall_arrayref( # or whatever "SELECT * FROM catalog WHERE $cond", undef, @items);

In this case, it's a very good idea to log the query string, as well as the values of each placeholder.

--
F o x t r o t U n i f o r m
Found a typo in this node? /msg me
The hell with paco, vote for Erudil!