Beefy Boxes and Bandwidth Generously Provided by pair Networks
Perl: the Markov chain saw

Re^5: Multiple SQL statements in DBI

by mje (Curate)
on Sep 07, 2012 at 23:59 UTC ( #992409=note: print w/replies, xml ) Need Help??

in reply to Re^4: Multiple SQL statements in DBI
in thread Multiple SQL statements in DBI

I don't believe DBI prevents any SQL. As far as I am aware prepare is a method in the individual DBDs. I don't believe that quote from the DBI pod has anything to do with SQL injection.

Just a few reasons why multiple SQL statements in the same prepare/do call are problematic (or unsupportable as is):

Some DBDs "parse" (mostly roughly) the SQL passed to prepare in order to try and identify placeholders. e.g., DBD::ODBC does this but only because DBI says placeholders may be specified with :name or ? and ODBC itself only defines the latter. I doubt vey much that of those DBDs which parse the SQL to find placeholders many (if any) support recognising N bits of SQL separated by ; So imagine if you did "insert into mytable values(?);insert into mytable values(?)" then any DBD which parses the SQL looking for placeholders may be fooled into thinking you need 2 but in actual fact the database probably executes these sepately.

Generally speaking the databases which support multiple statements in the same prepare run them individually and often there is something required to make it move from one to the next. Imagine 2 select stmts for differing numbers of columns - you need to stop in between them. Imagine an insert followed by another insert (your example), what is to be returned by execute when it is defined as returning the number of affected rows.

Then there are batch statements like execute_for_fetch and execute_array. How is the tuple status to be returned for multiple statements.

There are just too many things which don't fit.

Replies are listed 'Best First'.
Re^6: Multiple SQL statements in DBI
by tel2 (Pilgrim) on Sep 08, 2012 at 02:25 UTC
    OK - thanks mje.  I'm with ya.  Thanks for your time.

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://992409]
and all is quiet...

How do I use this? | Other CB clients
Other Users?
Others taking refuge in the Monastery: (11)
As of 2018-06-21 18:00 GMT
Find Nodes?
    Voting Booth?
    Should cpanminus be part of the standard Perl release?

    Results (118 votes). Check out past polls.