Eeek. For one, unless you really, really trust your users to type
into the form, you're asking for trouble. Google for "SQL injection attack" or use super search here.state = 'CA'
Far better is to do something like
By doing this, the value will be quoted automagically as appropriate for MySQL, elimating the possibility that someone will typemy $sql = "SELECT city FROM table WHERE state = ?"; my $sth = $dbh->prepare($sql); $dbh->execute($FORM{state});
into the form and have the results ruin your day.1; drop table database
Then you have to read the results before finishing the statement handle and disconnecting.
Also, since you're using CGI, it is completely unecessary to attempt to disect the query string yourself (and dissecting query strings by hand can be trickier than it first appears). CGI is quite good at handling that for you. You can drop that entire chunk of code that sets up %FORM, and instead do
use CGI; my $cgi = CGI->new(); ... my $sth = $dbh->prepare($sql); $sth->execute($cgi->param('state')) or die ...
In reply to Re: Trying to print HTML table, erroring out.
by dws
in thread Print Array into 4 Column Table
by Anonymous Monk
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |