Re: Re: DBI, quoting and like

There seems to be a bit of confusion here.. I'm usually typing and passing values which do not contain any quotes, so to match "FinalFrontier" I just type "final" - without the quotes. The only time I need to match quotes are when they are contained within the word. (See example table above.)

I did already try DBI->quote(), just by putting it in the middle of my statement like so:

my $stmS = "SELECT .. WHERE Name = " . DBI->quote($name) . " .. ";
[download]

But that also didn't work, I figured it should do the same as binding parameters anyway..
As bart worked out, it seems to be a problem with how I used prepare, execute and selectcol_arrayref, which works without bound params, but not with them. (I dont really need the execute anyway.. that comes of replacing fetchall_arrayref with selectcol_arrayref, and not checking the rest).

Comment on Re: Re: DBI, quoting and like - SQLite Download Code

Replies are listed 'Best First'.
Re: Re: Re: DBI, quoting and like - SQLite by dws (Chancellor) on Feb 26, 2003 at 08:12 UTC
I did already try DBI->quote() ... This is problematic on two counts: First, DBI/DBD will quote for you automatically if you use query parameters and pass the value to `execute()`. This is the prefered way to go. Second, if you really must quote manually, you're generally better using `$dbh->quote`, which is driver-specific. (You'll get the driver-specific quote() when you use parameter binding.) The form you're using is generic. It basically does `$str =~ s/'/''/g; # ISO SQL2 return "'$str'";` [download] Note the extra enclosing quotes. Given the way you're building your query, this isn't what you want.	[reply] [d/l] [select]

Replies are listed 'Best First'.

Re: Re: Re: DBI, quoting and like - SQLite
by dws (Chancellor) on Feb 26, 2003 at 08:12 UTC

I did already try DBI->quote() ...

This is problematic on two counts:

First, DBI/DBD will quote for you automatically if you use query parameters and pass the value to execute(). This is the prefered way to go.

Second, if you really must quote manually, you're generally better using $dbh->quote, which is driver-specific. (You'll get the driver-specific quote() when you use parameter binding.) The form you're using is generic. It basically does

    $str =~ s/'/''/g;        # ISO SQL2
    return "'$str'";
[download]

[reply]
[d/l]
[select]