Re: [LIP] Cleaning of input prior to entering into a database

On 31/03/05 14:06 -0500, [email protected] wrote:
> Hi All,
> 
> Do you think this is enough cleaning before entering arbitrary text into
> a PostgreSQL database?
> 
>         $_ =~ s/'/''/g;
>         $_ =~ s/;/\;/g;
>         $_ =~ s/insert/isnert/gi;
>         $_ =~ s/delete/dleete/gi;
>         $_ =~ s/select/sleect/gi;
>         $_ =~ s/update/udpate/gi;
>         $_ =~ s/drop/rdop/gi;
>         $_ =~ s/alter/atler/gi;
>         $_ =~ s/grant/garnt/gi;

Why not use DBI->quote, or even better, placeholders? It isn't very hard
to generate dynamic queries using Perl.

Devdas Bhagat


-------------------------------------------------------
This SF.net email is sponsored by Demarc:
A global provider of Threat Management Solutions.
Download our HomeAdmin security software for free today!
http://www.demarc.com/info/Sentarus/hamr30