MadHatter,

Actually not true, check out what the DBI docs say about such SQL injection attacks:

(In the "General Interface Rules & Caveats" section on this page)

Multiple SQL statements may not be combined in a single statement handle ($sth), although some databases and drivers do support this (notably Sybase and SQL Server).

Although this is by no means a reason not to validate your strings before dumping them into a DB.

-stvn