If you are talking about constructing an sql statement in something like this manner: 
my $table = "some_table";
my $columns = "foo,column2,another_col";
my $where_cond = "foo like '%bar%'";
$where_cond .= " and column2<4";

my $sql = "select $columns from $table where $where_cond";

[download]
The "quote()" function (and the more sensible strategy of using "?" placeholders for values instead of quoted strings) cannot apply in this sort of construction. It only works in positions where SQL syntax would allow a quoted value to be used (i.e. in place of '%bar%' and "4" in the examples above).

In reply to Re: Perl + DBI + mysql - Escaping Strings by graff
in thread Perl + DBI + mysql - Escaping Strings by ayapejian

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.