in reply to How to optimise " csv into mysql " using Text:CSV_XS and DBD::Mysql

my $query = qq{INSERT INTO some_table (id,$fieldList) VALUES (id,$field_placeholders)};

Side comment: Dynamic SQL is not secure. Admittedly, this one is more interesting in that it actually uses placeholders, but, building the placeholders string kind of defeats the purpose. That is, there's a benefit that strings need not be escaped and there will be strong typing, but the statement is no more secure.

If you're just doing an import, mysql supports it directly with LOAD DATA INFILE.

  • Comment on Re: How to optimise " csv into mysql " using Text:CSV_XS and DBD::Mysql

Replies are listed 'Best First'.
Re^2: How to optimise " csv into mysql " using Text:CSV_XS and DBD::Mysql
by Your Mother (Archbishop) on Aug 06, 2015 at 13:48 UTC

    The usage of placeholders in the OP's code is secure and normal; maybe a little idiomatic but common. There's no programmatic difference between–

    $sth = $dbh->prepare("something something ?, ?");
$sth->execute(@args);

    [download]

    –and–

    $place = "?, ?";
$sth = $dbh->prepare("something something $place");
$sth->execute(@args);

    [download]
[reply]
[d/l]
[select]

      But it isn't "something something", its "$fieldList."

[reply]

        Ah, quite right... seems to be trusted data. But still quite right.

[reply]

In Section Seekers of Perl Wisdom