Where is this text file generated? If its contents are affected in any way by user input, you open yourself up to SQL injection attacks. Please be careful.
That issue addressed, I don't know where this executeSQL() sub comes from, but if you were using DBI, my advice would be to use a placeholder in the query:
$sth = $dbh->prepare('SELECT * FROM all_tables WHERE table_name = ?'); $sth->execute($table_name); while (@row = $sth->fetchrow_array) { print "@row\n"; }
If you can't use DBI, then a simple substitution will work in a pinch:
my $sql = <$filecontent>; $sql =~ s/\$table_name/$table_name/e;
In this case, however, you now have to also ensure that $table_name is also safe from SQL injection, if it can be influenced by user input.
In reply to Re: Storing a variable in a file and processing within the script
by rjt
in thread Storing a variable in a file and processing within the script
by tony@perlmonks.org
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |