Did you try a Google Search? This is quite a known problem. Also read up on Placeholders and Bind Values from the DBI documentation

Hope this helps

# this works, but don't do it... The "correct" way is bind-vars
$value = $dbh->quote("sneaky text with posessives' in it");  $sql = "u
+pdate set column = $value";
[download]

The coolest most modern way to do it is bind vars:

# Do this every time:
my $sth = $dbh->prepare("update table set column=?") or die $dbh->errs
+tr;
   $sth->execute("sneaky text with posessives' in it") or die $dbh->er
+rstr;
[download]

If you use the bind-vars every single time, you'll very rarely have the kinds of horrible security problems that plague early php programs (sql injection).

1. Use place holders. See the DBI manual.
2. Use the quote method in the DBI.
3. $value =~ s/'/''/g;