in reply to Oracle Placeholder Problem in my Perl Script
Do not, ever, embed values from variables directly into a query. Use placeholders instead, that is, typically, a question mark for every value, without any quotes:my $query_detail1 = "select querydata from querydetail where querytitl +e='$querytitle'"; my $query_records1 = $conn->prepare($query_detail1)
You later have to pass the proper value(s) when you call the execute method on the statement handle:my $query_detail1 = "select querydata from querydetail where querytitl +e=?"; my $query_records1 = $conn->prepare($query_detail1)
$query_records1->execute($querytitle)
I don't know the query select * from EMP where EMPNO = &eno syntax. Is this some form of placeholder too? If so, it doesn't look familiar, and Google doesn't help me there. (Placeholders in Oracle typically look like ":foo"; and I think that that syntax will work from DBI too.)
|
|---|