in reply to Common untainting methods?

You can generally store any arbitrary binary data you want in a DB (but that of course depends ;-) Anyway to ensure the insert does not fail you need to quote some chars. With Perl and DBI all you actually need to do is is use placeholders ie:

my $data = "some 'arbitrary' data....."; my $more_data = "\007\000\007"; $sth = $dbh->prepare( 'INSERT INTO table (col1, col2) VALUES (?,?)' ); $sth->execute( $data, $more_data);

The next it depends comes from what you plan on doing with the data when you RETRIEVE it from the DB..... If you are going to do open $data; eval $data; system $data; etc then you do need to untaint it. However whether you untaint it on DB insertion or not I would personally still redo the untaint prior to use, that way if someone corrupts your DB data it will not cause you undue grief.

cheers

tachyon