in reply to db user and cgi pardigm
untainting all user input is an important thing, however, if you're using DBI.pm you may want to use placeholders; there's also a section on that in the DBI docs. if you use placeholders then DBI will take care of quoting the actual data correctly; but of course it will be helpful to additionally look into the data before if it contains the format you want.
about the cronjob: why don't you want to use a DB-connection directly? only if you expect high traffic this can be a bottleneck, but then i would consider using mod_perl instead of CGI, so the db connection can be programmed persistent.
|
|---|