Re: PerlOO what i am doing???

[chacham]

As a side note, building SQL strings is dynamic SQL. It is inefficient, pone to error, and allows for SQL injection.

As you're using prepare and execute on the actual statements, you can use placeholders and pass the variable's in a hash (the optional second parameter to execute), which is the first line of defense against SQL injection and more efficient.

That is, instead of:

my $sql = "select MNref from comment_record where MNid=" . "\"$self->{
+_MNid}\"";
my $ccr = $dbh->prepare($sql);
$ccr->execute() or die "$!";

use

my $sql = "select MNref from comment_record where MNid= ?";
my $ccr = $dbh->prepare($sql);
$ccr->execute($self->{_MNid}) or die $ccr->errstr;

It's also a lot easier to read. Note, also, return DBI's error, instead of just $!.