Thanks for the help, I will look up DBI and check out the fetchrow commands. As for the place holders I am not sure what your saying. is the "?" the placeholder command and when I pass a file name via execute it replaces "?" with "$filename"? Also how does passing the variable via execute and not prepare stop an injection attack?