Where is this text file generated? If its contents are affected in any way by user input, you open yourself up to SQL injection attacks. Please be careful.

That issue addressed, I don't know where this executeSQL() sub comes from, but if you were using DBI, my advice would be to use a placeholder in the query:

$sth = $dbh->prepare('SELECT * FROM all_tables WHERE table_name = ?'); $sth->execute($table_name); while (@row = $sth->fetchrow_array) { print "@row\n"; }

If you can't use DBI, then a simple substitution will work in a pinch:

my $sql = <$filecontent>; $sql =~ s/\$table_name/$table_name/e;

In this case, however, you now have to also ensure that $table_name is also safe from SQL injection, if it can be influenced by user input.


In reply to Re: Storing a variable in a file and processing within the script by rjt
in thread Storing a variable in a file and processing within the script by tony@perlmonks.org

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":



  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.