I'm a newbie to SQL. When I tried to run a CGI with this:I get a 500 error.my $sth = $dbh->prepare(<<SQL) or die $dbh->errstr; select count(*) from userlist where colemail = \'$FORM{'email'}\'; SQL $sth->execute;
Drop the semicolon. A lot of SQL engines trip over them.
Taint error. Why aren't you using placeholders? Even if this could work for well-behaved user data entries, it can still easily fail for others. Using a placeholder would prevent that.
And if you've connected to the database with the raiseError attribute set to true, there's no need for the or die... part.
my $sth = $dbh->prepare(<<SQL); select count(*) from userlist where colemail = ? SQL $sth->execute($FORM{email});
In reply to Re: SQL causing 500 error (was: What's Wrong With This?)
by bart
in thread SQL causing 500 error (was: What's Wrong With This?)
by Anonymous Monk
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |