in reply to regex "filters", stripping characters

Someone else already suggested that you use a different delimiter. That isn't the problem though it "corrects" the issue for the moment. The real problem is that you are aren't using DBI's placeholders. Until you switch you are (most likely) going to be vunerable to a variety of SQL insertion attacks. This is a security issue and you should address this before anything else.

  • Comment on Re: regex "filters", stripping characters

Replies are listed 'Best First'.
Re: Re: regex "filters", stripping characters
by powerhouse (Friar) on Jan 26, 2004 at 07:38 UTC
    Thanks for the info. I am aware of that. However, this is on a dedicated server, and is a file I am executing only from shell. It won't run from a browser, and it's not in a public directory. I'm only using it to parse these 15 files, with each containing 100,000 of his customers information(name, address, subscribe date, subscribed from IP, and phone number only). There are 1,500,000 of them, out of 20,000,000. These are customers that bought something from their company in the last 3 years.

    I'm going to delete the file after I'm done with these 15 files. I'll re-upload it when he sends me the rest to upload into the db for him.

    Thanks again for the concern :o)

    thx,
    Richard
[reply]
      Apart from the security concern, it's much easier, faster and shorter to use placeholders instead of trying to mangle the data into submission yourself. Probably there will be data in one of the files in the next batch which your regex won't catch. Why risk corrupt data or staring at the regex again when there is a perfectly good solution to your problem?

      Arjen

[reply]
      You could allow traffic from an IP to your mysql box and run it from any shell in the world. As long as it was internal to the network. Unless this is at some I/ASP :)

      Play that funky music white boy..
[reply]

In Section Seekers of Perl Wisdom