vsailas has asked for the wisdom of the Perl Monks concerning the following question:

Hi monks,
I was required to program for a database driven web page and I had used DBI module directly on each cgi's to connect to database.
Most people say it is not a good practice to make Database connections directly and advised on using wrappers around DBI.
What sort of security threats can come also it would be very helpful if some one could guide me on how to get a wrapper around DBI done.

Thanking all in advance
Silas

Replies are listed 'Best First'.
Re: Wrapper around DBI
by afoken (Chancellor) on Apr 03, 2009 at 06:48 UTC

    Don't blindly adopt or write a wrapper just because "most people say it is not a good practice" to use DBI directly. What do you think the wrapper should do? Wrapping DBI just because "wrapping is good" is plain nonsense. For small CGIs that each just does one little thing with the Database, direct access via DBI may be the best implementation. Wrapping has a cost, usually it slows down things. If you build a big project, plan to store objects in an RDBMS, need to work with a dozen RDBMS, and so on, a wrapper may be a good idea. The wrapper could take care of SQL and meta-data differences, and an object relational mapper (ORM) could act as a wrapper removing the need to manually serialise and deserialise the objects, generating SQL automatically, and so on.

    Alexander

    --
    Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)
Re: Wrapper around DBI
by moritz (Cardinal) on Apr 03, 2009 at 07:09 UTC
    I agree with afoken - don't wrap unless you know exactly why you should wrap, and to which effect.

    Remember that DBI already is a wrapper, and abstracts away most database specific code (ie communication with the database server).

    That said there are many extensions and wrappers on CPAN already, mostly in the DBIx:: namespace.

Re: Wrapper around DBI
by dorward (Curate) on Apr 03, 2009 at 09:24 UTC

    As others have said already - don't leap into using a wrapper if you don't need it. Do make sure you use DBI safely though, make sure you sanitize your input (DBI Parameter Security), etc.

    If you do want to look at a wrapper, then I'm very fond of DBIx::Class which is a thing of beauty.

Re: Wrapper around DBI
by Your Mother (Archbishop) on Apr 03, 2009 at 22:17 UTC

    This is also worth taking a long walk through: DBI recipes.