Re: Avoid SQL injection

[Corion]

Avoiding SQL injection is simple. Use DBI placeholders.

Instead of concatenating your values into your string, put ? there, and then place the values in ->execute(...).

You have structured your code around concatenating strings, so I would first replace the sqlSelect</p> with something like:

sub sqlSingleRow( $sql, @placeholders ) {
    my $sth = $dbh->prepare( $sql );
    $sth->execute(@placeholders);

    # Do you really get only ever a single row back?
    my  (@r)=$c->fetchrow();
    $c->finish();
    return @r;
}

... and then use that routine like:

    my $sql_cat = <<'SQL';
        select ref_categorie
          from categorie_libelle_langue
             , libelle
             , langue
          from ref_categorie
         where libelle.libelle = ?
           AND categorie_libelle_langue.ref_libelle = libelle.id_libel
+le
           AND categorie_libelle_langue.ref_langue = langue.id_langue 
+AND langue.key = ?
SQL

    my ($cat) = sqlSingleRow($sql_cat, $category, $lang );