Escaping Single Quote using Bind and $dbh->quote

bchodo has asked for the wisdom of the Perl Monks concerning the following question:

Replies are listed 'Best First'.
Re: Escaping Single Quote using Bind and $dbh->quote by moritz (Cardinal) on Apr 04, 2011 at 20:04 UTC
When you use bind parameters, there's no need to quote the values you pass in. Please show the code that's causing the errors, and what errors you get. Please also read (and act according to) How (Not) To Ask A Question. Perl 6 - second systems done right	[reply]
Re: Escaping Single Quote using Bind and $dbh->quote by wind (Priest) on Apr 04, 2011 at 20:04 UTC
What craps out? Where is your code? My preferred way of dealing with escaping is to always use placeholders `my $sth = $dbh->prepare(q{INSERT INTO sales (product_code, qty, price) + VALUES (?, ?, ?)}; $sth->execute($product, $qty, $price) or die $dbh->errstr;` [download]	[reply] [d/l]
Re^2: Escaping Single Quote using Bind and $dbh->quote by chrestomanci (Priest) on Apr 04, 2011 at 20:33 UTC
Another reason for using place holders is to avoid SQL injection via something like Bobby tables.	[reply]
Re^3: Escaping Single Quote using Bind and $dbh->quote by locked_user sundialsvc4 (Abbot) on Apr 05, 2011 at 00:40 UTC
“Bobby Tables” ... `ROTFLMAO ... :-D`
Re: Escaping Single Quote using Bind and $dbh->quote by locked_user sundialsvc4 (Abbot) on Apr 05, 2011 at 00:29 UTC
As far as I am aware, if you use bind-parameters (which are unquoted question-marks), and provide a corresponding number of replacement values, say, to `execute`, then the SQL handler never cares about what those replacement values contain. (The SQL statement parser never sees the values.) The following comment in the DBI documentation for the `quote` method also gives me pause: The quote() method should not be used with "Placeholders and Bind Values". In short, I suspect that the code “that has been giving you a problem for years” isn’t correct. Could you please give a short, specific example of what you are doing now? (The SQL string, the `prepare` and the `execute`.)