Re: cgi.pm; DBI, filtering input?

"robert.waters" <robert.waters@xxxxxxxxx> wrote:
> Hi,
> I've decided to use HTML::Entities to do the tag encoding.
> I have another question though:
> How would I use DBI placeholders in the case of a multiple insert?
> I've got a field that takes a comma-delimited list with no limit on
> quantity.
> For instance, how would I convert this example to use placeholders?:
> $contentid=0;
> $sql = "INSERT INTO keyword (name, contentid) VALUES (";
> for (my $i=0; $i<@keywords; $i++) {
>
> $keywords[$i] = "(qw[$keywords[$i]],$contentid)";

I don't think that that is doing what you think it is doing. The qw
is not an operator, just the letters q and w.

>
> }
> $sql .= join(',', @keywords).")";
> # results in '...VALUES (("a",0),("b",0))' etc..

Even if that is what the results are, I don't think that that is correct
syntax for mysql. You shouldn't have the outer parenthesis.

Anyway, SQL text strings can be created on the fly with placeholders, just
like they can be created on the fly with data (only easier).

join ",", map "(?,?)", @keywords;

But I wouldn't bother. Just roll a loop with an execute inside it. Only
if/when that proves to be too slow would I consider trying to cram it all
into one SQL statement.

Xho

--
-------------------- http://NewsReader.Com/ --------------------
Usenet Newsgroup Service $9.95/Month 30GB
.

Relevant Pages

  • RE: Fetch without Execute...
    ... If you fix the execute, ... Is key a reserved word in MySQL? ... Also, you should be using placeholders, or at least DBI->quote, instead ... of interpolating external data directly into an SQL statement. ...
    (perl.dbi.users)
  • Re: How can i escape special characters( % [ _ ) in an Access SQL statement?
    ... It is a recommended practice to use @parameters to provide placeholders in ... Construct the Sql statement with parameters and assign ... the values by mapping each value to the corresponding parameter. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Re: Truncation Issues with SQL Server Insert Statement
    ... You know, to be more accurate, I am indeed using placeholders, ... after constucting my sql statement from my field names. ... amonotod (all lower case, btw... ...
    (perl.dbi.users)
  • Re: Dynamic DTS Task Challenge
    ... hardcoded name and SQL statement that includes the database name. ... Then use an activeX task to replace placeholders in the sql statements with this database name. ... Helge ...
    (microsoft.public.sqlserver.dts)
  • Re: cgi.pm; DBI, filtering input?
    ... >> How would I use DBI placeholders in the case of a multiple insert? ... I think Robert wanted multiple records to be inserted. ...
    (comp.lang.perl.misc)