... until somebody tries to enter a username that contains a '.
No argument with that. The various responses indicating the use of placeholders (including your own) are a better general solution.
My post was based on:
-
Frederic_S seemed to think that the quotes used in the assignment to $user_login_name would be propagated to the SELECT statement: "I thought if I pass the login_name in '' it would work ...".
-
The fact that what he was trying perhaps worked in a different language: "I'm new to perl (coming from PHP) ...".
-
The specific question asked: "... what I'm doing wrong?".
-
The code as presented which didn't indicate any user input.
I might also point out that when I started to type up my response there where no current replies: I wasn't intending to provide a better solution or invalidate any answers that were submitted in the few minutes before my own.
Update: Added a blockquote at the top.
| 