Re^3: untainting or encoding for shelled sqlplus update

[Herkum]

You don't know how much code he would have to refactor to make it all usable in DBI. It might be a day's worth of work, or a month.

Creating a DBI handle will only take a few minutes and can be a test account. This is certainly easier, for a quick fix, than rewriting the whole thing to use DBI.

[runrig]

Perhaps true...though if there is a lot of code, it's going to be a lot of work no matter what (not just creating "a DBI handle"). I imagine theres a lot of code with interpolated varables, e.g.

my $sql = <<EOT
select blah, blahblah
from blah_etc
where foo = '$bar'
EOT

For the least amount of work, I might use something like Interpolate and turn that in to something like:

my $sql = <<EOT
select blah, blahblah
from blah_etc
where foo = $quote{$bar}
EOT

(with %quote properly defined through Interpolate)

But even that is a lot of tedious work if there is a lot of SQL to change. I could be wrong, but I don't think it would be much more work to just go ahead and use DBI to execute the SQL and return results.

[goibhniu]

I've been looking at Interpolate. How would that take care of bad characters in $bar in your example?

[runrig]

Start with what Herkum suggests above. Make one database handle. But then create a function that (maybe untaints the data and then) calls $dbh->quote() on its argument and returns the results, then use Interpolate to tie a hash to that function. Or, don't use DBI, and just wing it to create your own escaping function.