Re: Safe handling of an SQL query

Le mardi 17 avril 2012 à 20:10 +0200, Michael Ludwig a écrit :
> Bonjour Vincent,
> 
> Vincent Veyron schrieb am 16.04.2012 um 22:21 (+0200):
> > 
> > I guess (in the message I forwarded to the list) Andreas is right,
> > though : the only way to be safe is to keep control of the query,
> > therefore keep it on the server.
> > 
> > I am doing this now, but passing parameters to the query becomes
> > cumbersome :-(
> 
> If you haven't done that already, you could take a look at the following
> three modules. While I have never used any of them I've bookmarked them
> for future opportunities …
> 
> https://metacpan.org/module/SQL::Interp
> https://metacpan.org/module/SQL::Abstract
> https://metacpan.org/module/DBIx::Simple
> 

Guten Tag Michael,

I did not know about those, but what I don't see the benefit compared to
using DBI directly, which is really concise. This is all I need to get a
reference to a data set :

    my $dbh = $r->pnotes('dbh_data');

    my $sql = 'SELECT ... FROM ... WHERE X=? AND Y=?';

    #collect data
    eval { $data = $dbh->selectall_arrayref($sql, { Slice => {} },
( $param_x, $param_y ) ) };


where dbh_data is a reference to a dbi connection using connect_cached,
stored in pnotes.

?

-- 
Vincent Veyron
http://marica.fr/
Logiciel de gestion des sinistres assurances et des dossiers contentieux pour le service juridique