I would always use placeholders simply for the speed increase they offer, but does the use of them imply the placeholder content is, for want of a better phrase, SQL-escaped for the actual DB in use?
My scan of the documentation didn't find that information for placeholders but seemed to imply that $db->quote() might. I would like to know for sure if placeholders also perform this function.
| [reply] [Watch: Dir/Any] [d/l] |
Yes it does wrap '' around them. Which can lead to problems when you say want to call a function such as NOW() - because then you don't want it quoted.
Have you tried freelancing? Check out Scriptlance - I work there. For more info about Scriptlance and freelancing in general check out my home node.
| [reply] [Watch: Dir/Any] |
It's hard to imagine a sensible application where an (untrusted) input data value for an SQL operation would properly include a call to an SQL-internal function. Something like "NOW()" would either be an invariant (hard-coded) piece of the SQL statement, or else would be something that is assembled and added to the SQL (or not) based on the presence/absence/value of some input parameter(s).
In the latter case, the value(s) of the parameter(s) would not go directly into the SQL string, but would only be tested to figure out what function call(s), if any, should be added (as literals) to the SQL. Example:
my @flds = ( qw/foo bar status/ );
my @vals = @param{@flds};
my $valstr = join( ",", ("?") x @flds );
if ( $param{timestamp} ) {
push @flds, "timestamp";
$valstr .= ",NOW()";
}
my $sql = "insert into mytable (" . join( ",", @flds ) . ") values ($v
+alstr)";
my $sth = $dbh->prepare( $sql );
$sth->execute( @vals );
There are other ways to handle this that would suffice (e.g. careful regex matches on untrusted values in order to include things in the SQL statement), but as a rule, the application should have a limited inventory of function calls that it supports/allows.
| [reply] [Watch: Dir/Any] [d/l] |