in reply to Perl + DBI + mysql - Escaping Strings
The "quote()" function (and the more sensible strategy of using "?" placeholders for values instead of quoted strings) cannot apply in this sort of construction. It only works in positions where SQL syntax would allow a quoted value to be used (i.e. in place of '%bar%' and "4" in the examples above).my $table = "some_table"; my $columns = "foo,column2,another_col"; my $where_cond = "foo like '%bar%'"; $where_cond .= " and column2<4"; my $sql = "select $columns from $table where $where_cond";
|
|---|