Placeholder Help!

Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:

Hi Monks!
I need to use placeholder on this SQL Statement but I am stuck, how could I update this code using placeholders instead of variables in the sql statement, thanks for the help!
What is confusing me is the "$thisdata[]". Is it safe to use single quotes around values in SQL statements, like in "(number = '100')" or leave as it is in this sample code?
Thanks.

my $thisdata = [];
my $sql = "select users from my_table where (number = 100) and (serie 
+= 450)";
$thisdata = $dbh->exec_select( $sql );
[download]

Comment on Placeholder Help! Download Code

Replies are listed 'Best First'.
Re: Placeholder Help! by ikegami (Patriarch) on Jun 07, 2010 at 18:22 UTC
how could I update this code using placeholders instead of variables in the sql statement No variables are interpolated into the SQL statement you showed. What is confusing me is the "`$thisdata[]`". I'm confused too because that doesn't appear in what you posted. Did you post the wrong code??? One comment about the code you did post is that it's silly and confusing to assign a value to `$thisdata` only to replace it with a different value.	[reply] [d/l] [select]
Re: Placeholder Help! by ahmad (Hermit) on Jun 07, 2010 at 19:06 UTC
All what you need is to use prepared statements `my $query = $dbh->prepare("select users from mytable where number = ? +and serie = ?"); $query->execute(100,450); while ( my $row = $query->fetchrow_hashref ) { print $row->{'users'}; }` [download] I don't remember seeing an exec_select method in the DBI class (I might be wrong).	[reply] [d/l]
Re^2: Placeholder Help! by chromatic (Archbishop) on Jun 07, 2010 at 20:55 UTC
In this case, the use of placeholders is unnecessary. Values hard-coded in SQL--especially simple integers like this--have no security risks or negative performance implications. Interpolating variables into SQL strings is a security risk. With that said, if you have a SQL abstraction system, using placeholders is fine if it reduces duplicate or near-duplicate code, but that appears not to be a concern here.	[reply]