Have a look at Re: Sessions, Perl and MySQL for some hints on working with databases. Although people are aware of SQL injection it never ceases to astound me that possibly 50% of all online databases will dump themseleves for you if you query for '%' or 'a%', 'b%', ... 'z%'. If you are going to allow searches using LIKE %<USER_INPUT>% think about the results if you search for wildcards.....