Re^3: Multiple SQL statements in DBI

Ah, in that case:

Placeholders and bind-values are what you should be using. They would prevent the possibility of an SQL injection attack. Even if the semicolon isn't the issue, there are other things user-supplied input could do when interpolated into the middle of an SQL statement. But placeholders eliminate the interpolation, and overcome that issue. While you might not be able to construct an attack with a semicolon, I wouldn't be too confident that you've eliminated all attack vectors. At least with placeholders you can cross the SQL injection attack off the list.

Dave

Comment on Re^3: Multiple SQL statements in DBI

Replies are listed 'Best First'.
Re^4: Multiple SQL statements in DBI by tel2 (Pilgrim) on Sep 07, 2012 at 22:16 UTC
Thanks Dave. Yeah - I've been using placeholders & bind-variables, but did wonder about the need for those given my findings with DBI not allowing multiple statements, but you've semi-answered that, so thanks!	[reply]
Re^5: Multiple SQL statements in DBI by davido (Cardinal) on Sep 07, 2012 at 22:24 UTC
Well for one thing a malicious user could supply the necessary values for interpolation, and in the last value, close the parents and continue on with an inner join that is constructed to reveal what you never intended to reveal, or to consume tons of resources. Imagine a chain of "order by". Dave	[reply]