SQL Statement Not Firing Correctly?

[jdlev]

I haven't been able to figure this out. The program is throwing an error when I execute the update statement. All of the other regex expressions seem to work just fine, but when a person has an appostrophe in their name, the sql syntax get's messed up. I tried adding a second apostrophe in front of the one in the person's name, and it WORKS in phpmysql when I run the SQL statement. But when I run it in the following code, it doesn't work????

my $query = "SELECT Name FROM Table WHERE Name= 'Will Tu''ufo''ou'";
my $sth = $dbh->prepare($query);
$sth->execute();

while($name = $sth->fetchrow_array)
    {
        $originalName = $name;
        $name =~ s/jr//i; #removes 'jr' from names
        $name =~ s/III//i; #removes 'III' from names
        $name =~ s/\s+$//; #removes ' ' from end of name
        #print $name . "\n";

        if ($originalName =~ m/'/)
            {
                $originalName =~ s/'/''/g;
                print $originalName;
            }

        $updateQuery = "UPDATE week13dk SET Name = '$name' WHERE Name 
+= '$originalName'";
        my $uth = $dbh->prepare($updateQuery);
        $uth->execute();
    }

[Corion]

Consider DBI->quote or, even better, using SQL placeholders instead of constructing your SQL statement as a string.

Also see Bobby Tables.

[boftx]

I strongly second Corion's suggestions. I would only add that failing to use either (especially placeholders IMO) can lead to some serious security issues in some cases.