>I think you will need to show us more of your code.  Where are the ids
>coming from?

First the html generated by the script :
        <input type=checkbox name="IDS" value="26,">
        <input type=checkbox name="IDS" value="18,">

I get this html by doing :

                    while(@row = $sth->fetchrow_array) {

                        if($tmp_bgcolor eq "$bgcolor_a") { $tmp_bgcolor
= $bgcolor_b; }
                        else { $tmp_bgcolor = $bgcolor_a; }

                        $code = '';
($tmpa = $row[0]) =~ s/([^\x20-\x7E])/'\x' . sprintf "%x", ord $1/ge;
$code = "<tr bgcolor=$tmp_bgcolor><td> -$tmpa- <input type=checkbox
name=\"IDS\" value=\"$row[0],\"> </td><td>";
$code ="$code <a target=\"_blank\"
href=\"$mysql_man_script_name?req_lib=$req_lib&req_id=$row[0]&action=see
_rec\"> View Rec
ord </a> Deleted By : $row[1] On : $row[2] ::
$row[$menu_option_index_num]";
                        $code = "$code </td></tr> \n";
                        print $code;
                        $code = '';
                }

With the altered code it outputs :

        -28- <input type=checkbox name="IDS" value="28,">
        -18- <input type=checkbox name="IDS" value="18,"> 

If you check them both and submit, it does this script :
                $ids = $in{'IDS'};
                $ids =~ s/\,$//;   
print "-$ids-<br>";# which out put -> -27,18-
($tmpa = $ids) =~ s/([^\x20-\x7E])/'\x' . sprintf "%x", ord $1/ge;  
print $tmpa; # which out put -> 27,\x018
print "<br>"; 
                @recs = split(/,/, $ids);

>Perhaps the later ids include a non-printable character, which trace()
is
>outputting as a period.  Try printing your query like this:
>($tmp = $query) =~ s/([^\x20-\x7E])/'\x' . sprintf "%x", ord $1/ge;
>print $tmp;

$tmp prints out as : DELETE FROM customer WHERE ID IN ('25','\x018') 
sure enough odd char
It seems to get there somewhere in between pressing submit and after
parse 
( I use the &ReadParse subroutine in cgi-lib )

I just did "$query =~ s/([^\x20-\x7E])//ge;"
 to remove any nonprintable chars right before do() and all is well.
Thanks for the idea! I still wonder where it's coming from.
Any ideas how a non printable character would get ther ewould be good to
know.

Thanks for your help everyone!
Dan
>Ronald

Reply via email to