Akoya, the DBI module will sanitize the parameters you pass in to placeholders in a prepared statement:
my $sth = $dbh->prepare("SELECT * FROM foo WHERE bar = ?");
$sth->execute("my 'scary variable here';");
Whereas if you just did it using $dbh->do():
$dbh->do("SELECT * FROM foo WHERE bar = " . "my scary 'variable here';
+");
You would have a problem, because the ' and ; characters would not have been escaped - and would therefore do Bad Things™ to your database.
| [reply]
[d/l]
[select] |
my $sth = $dbh->prepare("update thetable set that=? where this=?");
$sth->execute($that, $this)
I believe he means that $this and $that are sql safe below. $this could easily be "1;delete from thetable" the engine would merely look for column data of that string, not append the information. Unlike something like ...
my $sth = $dbh->prepare("update thetable set that=$that where this=$this");
| [reply] |