And use placeholders (those question marks). Now, if your form fields are named JUST LIKE your database table columns, then you can do some tricks to save typing and prevent typos:my @field = qw( Title Email City State Country URL Date Description rid dt_create publish ); my $insert_sth = $dbh->prepare( 'INSERT INTO ads_2004 (' . join(', ', map "'$_'", @fields) . ') VALUES (?,?,?,?,?,?,?,?,NULL, NOW(), 0)' );
By the way, your SQL snippet has ELEVEN fields and only TEN values. This is the kind of typo i was talking about. ;)use CGI qw(:standard); my %field; for (@field) { my $param = param($_); die unless $param; # do validation on $param here ... $field{$_} = $param; } # or validate specific pieces outside the loop: die unless $field{rid} =~ /^\d+$/; die unless is_valid_email($field{Email}); $insert_sth->execute(values %field);
jeffa
L-LL-L--L-LL-L--L-LL-L-- -R--R-RR-R--R-RR-R--R-RR B--B--B--B--B--B--B--B-- H---H---H---H---H---H--- (the triplet paradiddle with high-hat)
In reply to Re: Right answer (wrong question...)
by jeffa
in thread Right answer (wrong question...)
by bobafifi
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |