RE: How to store query results in an array?
- From: jkstill@xxxxxxxxxx (Jared Still)
- Date: Thu, 26 May 2005 07:40:04 -0700
On Thu, 2005-05-26 at 07:05, Ronald J Kimball wrote:
> Regardless of the method you use to construct the query, you should not
> quote the values by hand. This approach will fail if a value contains a
> single quote, and may make you vulnerable to SQL injection attacks.
Yes, thank you. A bad habit I should get out of.
> Instead, either call $dbh->quote() or use placeholders. For example:
>
> my @users = map $_->[0], @$aryRef;
> my $newSql = 'SELECT FROM users WHERE username IN (' .
> join(', ', map $dbh->quote($_), @users) . ')';
>
> Ronald
>
.
- Prev by Date: RE: LongReadLen issue
- Next by Date: RE: LongReadLen issue
- Previous by thread: RE: How to store query results in an array?
- Next by thread: RE: How to store query results in an array?
- Index(es):
Relevant Pages
|
