we use 'cgi' and plain sql for this. eg:

# Untested snips of code

if ($query->param('type') eq 'upload') {
    my $cgi = new CGI;
    my $fh = $cgi->param($upload_field_name);
    
    while (read($fh,$buffer,BUFFER_SIZE)) {
        $value .= $buffer;
    }
  # mind the danger of this sql syntax, where $value may be 
  # a ; separated value to some 'hackers'.
  # however, i believe DBI::Sybase doesn't allow ? and execute($value)
+;
  # use a regexp to filter out update, delete, create, alter etc.
  $sth = $dbh->prepare('update table set value = ' . $value . ' where 
+...');
  

}
[download]