Re: Avoiding SQL insecurities

[Belgarion]

You may also want to look into something like Class::DBI as a means of interfacing with your database. Class::DBI handles the SQL translation correctly without any interaction by you.

Even if you don't end up using the module it is a good piece of code to study to see how to work with a database from within Perl.

[eclark]

Always use placeholders. Examples below.

$dbh->do('UPDATE table SET col = ? WHERE id = ?', {}, $value, $id);

my $sth = $dbh->prepare('SELECT foo, bar FROM table WHERE baz = ?');

$sth->execute($baz);