Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:

hi,
i have following statements in my cgi script. i use mysql database.

$strAns = $dbh->quote($strAns);
my $statm = qq<INSERT INTO perlDesk_user_response VALUES (?,?,?)>;
my $stmtInsert = $dbh->prepare($statm);
$stmtInsert->execute($callid,$nQsId,$strAns) or die "Couldn't execute statement: $DBI::errstr; stopped";

$strAns value before using quote function: i haven't attended.
when i read that value from database it is giving '\'i haven\\\'t attended.\''
i have checked the database. The value has been stored as '\'i haven\\\'t attended.\''
can u please pointout the mistakes i have made

thanks
kamesh
  • Comment on escaping special characters in mysql queries

Replies are listed 'Best First'.
Re: escaping special characters in mysql queries
by Happy-the-monk (Canon) on Nov 22, 2004 at 09:56 UTC

    The placeholders "(?,?,?)" already do the quoting for you.
    By using an additional $dbh->quote() you quoted your data twice.
    Best you stick to using placeholders and drop the additional $dbh->quote().

    Cheers, Sören

      i have dropped $dbh->quote() method..still iam not happy with my data..
      if my string is : i haven't attended
      the value is stored as 'i haven\'t attended'. when i read this value it gives 'i haven\'t attended' . But i wanted it as to be like original string. Please suggest how can i accomplish this thing.
      If my string is: i haven't attended. "may be i will do it".
      in the database the value is stored as: i haven\
      any clues..
      thanks
      kamesh

        when i read this value it gives 'i haven\'t attended'

        If that's the case, then at the time of writing you inserted \'i haven\\\'t attended.\' to the database;
        meaning it was still quoted twice. I assume that you either have another $dbh->quote() on that value somewhere in your code - or you are looking at old data in the database, not at the freshly inserted data.
        Did you check if the new insert succeeded or maybe failed for some reason?

        The data retrieved from the database (and not quoted after retrieving) should give i haven't attended - no backslashes.

        Update:

        in the database the value is stored as: i haven\

        That data is corrupted. It was inserted as "i haven\\'" - the "'" survived and was interpreted as string terminator because it was oddly quoted: the quoting did not affect it, it only quoted the other backslash. That's strange, it looks like manual tampering to me. If that's not the case, I am at a loss here =(

        Cheers, Sören