Re: How's My Style Now?

[chb]

Please please use placeholders in all SQL, everytime, everywhere, always. Imagine what happens when someone submits the value 0'; DROP TABLES; -- as $ref_id. If you use placeholders in your prepared statements, the DBI driver would quoute away some of the danger in this.

[Spenser]

I usually do use placeholders. However, in this case one of the three possible SQL statements has no value required. How would deal with that? For the other two I can create a variable (e.g., $particular) and set it in block of the elsif and the else, to be used like so, $sth->execute($particular);. However, for the if statement, won't I get an error even if $particular is set to blank?

[chb]

Just change your control flow slightly and prepare/execute the entire statement inside the if/elsif/else blocks (warning: untested code)

sub get_musings_entries {
# get musings from MySQL

my ($musing_id,$ref_id) = @_;
if($ref_id && $ref_id eq 'all') {
   $sth = $dbh->prepare(qq|SELECT musing_id, ref_id, 
                           heading,abstract, 
                           DATE_FORMAT(entry_date, '%M %e, %Y') 
                           FROM musings 
                           ORDER BY entry_date DESC|);
   $sth->execute();
}
elsif($ref_id) {
   $sth = $dbh->prepare(qq|SELECT musing_id, ref_id, 
                           heading, abstract, 
                           DATE_FORMAT(entry_date, '%M %e, %Y') 
                           FROM musings 
                           WHERE ref_id = '?'
                           ORDER BY entry_date DESC
                           LIMIT 10|);
   $sth->execute($ref_id);
}
else {
   $sth = $dbh->prepare(qq|SELECT musing_id, ref_id,  
                           heading, entry, 
                           DATE_FORMAT(entry_date, '%M %e, %Y') 
                           FROM musings 
                           WHERE musing_id = '?'|);
   $sth->execute($musing_id);
}

my $entries = $dbh->selectall_arrayref($sql_stmnt);
$sth->finish();  

return $entries;
}