$sth->execute($var) replaces the first placeholder with the contents of $var, taking care of proper escaping, and thus preventing SQL injection. Consider
$filename = "random.jpg'; drop table FanRatings; select 2 * 5,'"; $sth = $dbh -> prepare ( qq~select One, Two, Three from FanRatings where Title = '$filename +'~ ) or die $DBI::errstr; $sth->execute;
Oops, table FanRatings gone, and 10 and the empty string returned...
Whereas with placeholders, the embedded quotings in $filename will be escaped as the current database driver requires.
--shmem
_($_=" "x(1<<5)."?\n".q·/)Oo. G°\ /
/\_¯/(q /
---------------------------- \__(m.====·.(_("always off the crowd"))."·
");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}
In reply to Re^3: Check for null results
by shmem
in thread Check for null results
by Eagle_f90
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |