You're requesting the same form variables on each iteration. Besides that, interpolation occurs where you declare and assign the SQL statement -- not when you "re-assign" to $quantity and $gross_sales. Print $sql2 in the loop to see.

Placeholders are definitely the way to go -- though I've never used FreeTDS, I know that DBI emulates placeholders for databases that don't support them natively.

As for iterating over form variables, you're looping over the contents of the files named in @ARGV, or STDIN, which isn't what you want. I bet your loop contents aren't being executed once.

You need to figure out how to iterate over your form variables. If they have programmatic names, that's one way. If they have the same name, you'll have to read their contents into arrays. It's hard to say without seeing the HTML form.

though I've never used FreeTDS, I know that DBI emulates placeholders for databases that don't support them natively

Unfortunately DBI doesn't - however some drivers emulate placeholders (for example DBD::MySQL).

In the case of DBD::Sybase it is written with the Sybase libraries in mind, and in that situation will handle placeholders just fine. The problem is that FreeTDS isn't (yet) a complete implementation of the TDS protocol, and the reverse engineering problem is compounded by the fact that Sybase and MS have implemented placeholder handling differently.

However, there is hope - I understand that the next release of FreeTDS may support placeholders correctly.

Michael

my $sql2 = qq/
  INSERT INTO transaction_details (quantity, gross_sales)
              VALUES (?, ?)
/;

my $sth = $dbh->prepare($sql2);

while (<>) {  
    my $quantity = param("quantity");
    my $gross_sales = param("gross_sales");
     
    my $rv = $sth->execute($quantity, $gross_sales);
    # Handle error if $rv is false...
}
[download]

Michael

Thanks Michael. But in using FreeTDS and DBI Sybase (thank you) I haven't been able to use placeholders. My apologies for not listing the setup: Apache/Linux/Perl -> Win2K/SQL Server 7.0

Ah. Well in that case you'll have to move the prepare() into the loop (or use do()) and use interpolation (with the usual caveats about NULLs, etc.)

The naive version would look like this:

while (<>) {  
    my $quantity = param("quantity");
    my $gross_sales = param("gross_sales");
    my $sql = qq/
       insert into transaction_details(quantity, gross_sales)
             values($quantity, $gross_sales)
        /;
     my $rv = $dbh->do($sql);
     # check return value, etc.
}
[download]

You should of course check that the two input parameters are valid before submitting the SQL request.

Michael

  my $sql2 = qq/
     INSERT INTO transaction_details (quantity, gross_sales) 
      VALUES ($quantity,  convert (money, $gross_sales))
     /;
[download]

If so what I think you are trying to get at is something like :-

  my $sql2 = qq/
     INSERT INTO transaction_details (quantity, gross_sales) 
      VALUES (?,  convert (money, ?))
     /;# using bind parameters
   my $sth = $dbh->prepare($sql);

# Assuming that each row in the form has the form
#  {fieldname}_{rownnum}
   my %param = $cgi->Vars();
   while my $key (grep /quantity_/ keys %param) {  
     my $quantity = $cgi->param($key);
     $key =~ m/(\d+)$/;
     my $gross_sales = $cgi->param("gross_sales_$1");
     my $rv = $sth->execute( $quantity, $gross_sales );
   }
[download]

Hope it helps
UnderMine

while (<>) {  
       my $quantity = param("quantity");
       $quantity = $dbh->quote( $quantity );
       my $gross_sales = param("gross_sales");
       $gross_sales = $dbh->quote( $gross_sales );
       my $sql2 = qq/
          INSERT INTO transaction_details (quantity, gross_sales) VALU
+ES ($quantity,  convert (money, $gross_sales))
       /;
       my $rv = $dbh->do( $sql2 );   
}
[download]