If you have no control over the contents of $id, you shouldn't use it directly. What if $id was set to 42', 'Batman'); drop table customers; --?

In fact, I tried it with two different database drivers. Interestingly, in DBD::SQLite, the table wasn't removed, as it doesn't support multiple statements at a time. On the other hand, DBD::Pg happily removed the table and crashed when I tried using it later.

#!/usr/bin/perl
use warnings;
use strict;
use feature qw{ say };
use experimental qw{ signatures };

use DBI;

sub run_do($dbh, $id, $name) {
    $dbh->do(qq{
        INSERT INTO customers
        (id,name)
        VALUES('$id','$name')});
}

sub run_select($dbh) {
    my $sth = $dbh->prepare('SELECT * FROM customers');
    $sth->execute;
    while (my @row = $sth->fetchrow_array) {
        say "@row";
    }
}

my %connection = ('dbi:SQLite:dbname=:memory:' => ["", ""],
                  "dbi:Pg:dbname=$ENV{USER}" => [$ENV{USER}, ""]);

for my $dbcs (keys %connection) {
    my $dbh = 'DBI'->connect($dbcs, @{ $connection{$dbcs} });
    $dbh->do('CREATE TABLE customers (id INTEGER, name TEXT)');

    run_do($dbh, 1, 'John');
    run_select($dbh);

    my $id = q{42', 'Batman'); DROP TABLE customers; -- };
    run_do($dbh, $id, 'Joe');
    run_select($dbh);
}

[download]

The output: 

1 John
1 John
42 Batman
1 John
DBD::Pg::st execute failed: ERROR:  relation "customers" does not exis
+t
LINE 1: SELECT * FROM customers
                      ^ at ./1.pl line 18.
DBD::Pg::st fetchrow_array failed: no statement executing at ./1.pl li
+ne 19.

[download]

You can always fix that by wrapping the value into a quote: 

    $dbh->do(join "",
             'INSERT INTO customers(id,name) VALUES(',
             $dbh->quote($id), ', ',
             $dbh->quote($name),
             ')');

[download]

map{substr$_->[0],$_->[1]||0,1}[\*||{},3],[[]],[ref qr-1,-,-1],[{}],[sub{}^*ARGV,3]

In reply to Re^5: DBI do() SQL injection by choroba
in thread DBI do() SQL injection by Anonymous Monk

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.