Some great advice!

I have a small shop doing two things - Per/Tk for stand-alone apps for a variety of platforms - AND Perl with MySQL webb-apps and CGI.

My list of indispensable stuff includes SQL::Abstract, CGI::FormBuilder, HTML::QuickTable, HTML::Template.

I am also looking at other modules to help, CGI::Session and Apache::Session among them along with CGI::Application.

Currently I do input field validation, and a degree of untainting, by having generic subroutines that use the metadata from the MySQL database itself. Here is one attempt at a sub that returns a HASH of table information.

sub getTableStructure {
    # need: $dbh
    #        tablename
    # returns: hash of field(column) records

    my ($dbh, $tablename) = @_;
    my %struct_hash;
    my $SQL = "SHOW COLUMNS FROM $tablename";
    my $sth = $dbh->prepare( $SQL );
    $sth->execute();
    while ( my $inphash = $sth->fetchrow_hashref() ) {
        $struct_hash{$inphash->{Field}} = $inphash->{Type};
    }
    return %struct_hash;
}
[download]

This hash can be used to look at the structure for each field and can help you automate the validation process. This code was written in a rush for a project that would have otherwise need a host of validation subs. I have to go back and clean up all of it, but maybe you get the idea of what I did.

jdtoronto