Beginning Web Development With Perl : From Novice to ... - Nabo

62CHAPTER 3 ■ DATABASES AND PERLwhen input is allowed unchecked or the program executes a SQL statement without first properlysanitizing it for the database’s consumption. The DBI contains an aptly titled quote() method toproperly escape or sanitize SQL statements for you.You should use the quote() method for any statement that will use parameters or othervariables or input that could possibly be dirty. The quote() method belongs to a database handle,since nearly every database server has its own set of rules for quoting. Consider this code,assuming a database handle of $dbh has already been created:my $dirtystring = "This is some %really% \"weird\" \\* input";my $cleanstring = $dbh->quote( $dirtystring);my $sth = $dbh->prepare("SELECT * from tablename where something = $cleanstring");So, the example shown earlier in this section might look like this:my $usernamein = "suehring";my $sth = $dbh->prepare("SELECT host FROM mysql.user WHERE user = " .$dbh->quote($usernamein . " ");While it may seem like a hassle to need to clean up input and other parameters beforeusing them in a statement, the trade-off is well worth the extra typing. I could go into a storyakin to the age-old “I used to have to walk 18 miles a day to school” of how life was prior to thequote() method, but rest assured that using quote() is much easier and simpler than needingto do the same function manually against all input.Executing Other SQL StatementsNot all statements must go through the prepare() and execute() methods, or even createa statement handle prior to being run against the database server. The database handle’s do()method executes a statement immediately against the database. This is useful for performingactions like DELETE, INSERT, and UPDATE, which don’t actually retrieve any results from the database,but merely perform an action against the database.The do() method is used in the context of a database handle. Assuming a database handleof $dbh with a table called table, you might use do() like this:my $rows = $dbh->do("DELETE from table where id = '4'");The $rows variable would contain the number of rows affected by this statement. If thestatement executes successfully, regardless of the number of rows deleted, the do() methodwill return true. In other words, the rows affected could still be zero, even though the statementexecuted successfully.Binding ParametersAs you saw earlier, you can use the quote() method to create dynamic SQL statements. However,another method exists for creating such statements, namely parameters. Parameters arealso known by a few other names or concepts, such as binding or placeholders. When you hearone of these terms, it’s referring to the concepts described in this section.