Database insertion, escape issue

2007-06-12 Thread Northstardomus
I have a Perl script where I try to strip some data from a web page and insert it into a database. I'm having a problem where, it seems like the method of quoting the data for insertion don't seem to be working (as far as escaping the text) and some of the text is ending up getting injected int

Re: Database insertion, escape issue

2007-06-12 Thread Tom Allison
On Jun 11, 2007, at 7:52 PM, Northstardomus wrote: I have a Perl script where I try to strip some data from a web page and insert it into a database. I'm having a problem where, it seems like the method of quoting the data for insertion don't seem to be working (as far as escaping the text)

Re: Database insertion, escape issue

2007-06-12 Thread Mumia W.
On 06/11/2007 06:52 PM, Northstardomus wrote: [...] print "Inserting into Database , @values."; Use the "quotemeta" function to escape special characters that may be in the values. my @values_copy = @values; @values = map quotemeta($_), @values; $dbh->do("INS

Re: Database insertion, escape issue

2007-06-12 Thread Jenda Krynicky
From: "Mumia W." <[EMAIL PROTECTED]> > On 06/11/2007 06:52 PM, Northstardomus wrote: > > [...] > > print "Inserting into Database , @values."; > > Use the "quotemeta" function to escape special characters > that may be in the values. Please don't! > my @values_copy = @values; >

Re: Database insertion, escape issue

2007-06-12 Thread Northstardomus
On Jun 12, 8:48 am, [EMAIL PROTECTED] (Jenda Krynicky) wrote: > From: "Mumia W." <[EMAIL PROTECTED]> > > > On 06/11/2007 06:52 PM, Northstardomus wrote: > > > [...] > > > print "Inserting into Database , @values."; > > > Use the "quotemeta" function to escape special characters > > that may

Re: Database insertion, escape issue

2007-06-12 Thread Northstardomus
On Jun 12, 4:59 am, [EMAIL PROTECTED] (Tom Allison) wrote: > On Jun 11, 2007, at 7:52 PM, Northstardomus wrote: > > > > > > > > > I have a Perl script where I try to strip some data from a web page > > and insert it > > > into a database. I'm having a problem where, it seems like the method > > of

Re: Database insertion, escape issue

2007-06-12 Thread Northstardomus
On Jun 12, 8:48 am, [EMAIL PROTECTED] (Jenda Krynicky) wrote: > From: "Mumia W." <[EMAIL PROTECTED]> > > > On 06/11/2007 06:52 PM, Northstardomus wrote: > > > [...] > > > print "Inserting into Database , @values."; > > > Use the "quotemeta" function to escape special characters > > that may

Re: Database insertion, escape issue

2007-06-12 Thread Chas Owens
On 6/12/07, Northstardomus <[EMAIL PROTECTED]> wrote: snip $dbh->prepare('INSERT INTO area_status (areaID, survey_date, update_time, status ) VALUES (?,?,?,?)'); $dbh->execute('$values[0]', '$values[1]', '$values[2]', '$values[3]'); snip You are getting an error because $dbh->pr

Re: Database insertion, escape issue

2007-06-12 Thread Tom Allison
$sth->execute() and read up on DBI a little more. the first page of the perldoc shows a synapsis of all the commands. I frequently have to re-visit these pages to recall what the different functions are. On Jun 12, 2007, at 1:32 PM, Northstardomus wrote: On Jun 12, 4:59 am, [EMAIL PROTECTE

Re: Database insertion, escape issue

2007-06-13 Thread Northstardomus
On Jun 12, 6:34 pm, [EMAIL PROTECTED] (Chas Owens) wrote: > On 6/12/07, Northstardomus <[EMAIL PROTECTED]> wrote: > snip> $dbh->prepare('INSERT INTO area_status (areaID, survey_date, > > update_time, status ) VALUES (?,?,?,?)'); > > $dbh->execute('$values[0]', '$values[1]', '$values

Re: Database insertion, escape issue

2007-06-13 Thread Chas Owens
On 6/13/07, Northstardomus <[EMAIL PROTECTED]> wrote: snip $sth->execute($values[0], $values[1], $values[3]) or die $dbh- snip Two things: 1. If you always want to die on failure it is easier and safer to say my $dbh = DBI->connect( $dsn, $user, $pass, { RaiserError =>

Re: Database insertion, escape issue

2007-06-14 Thread Jenda Krynicky
From: Northstardomus <[EMAIL PROTECTED]> > ... > $dbh->prepare('INSERT INTO area_status (areaID, survey_date, > update_time, status ) VALUES (?,?,?,?)'); > $dbh->execute('$values[0]', '$values[1]', '$values[2]', > '$values[3]'); Apart from the $sth already explained by others, ther

Re: Database insertion, escape issue

2007-06-14 Thread Northstardomus
On Jun 14, 6:59 am, [EMAIL PROTECTED] (Jenda Krynicky) wrote: > From: Northstardomus <[EMAIL PROTECTED]> > > > ... > > $dbh->prepare('INSERT INTO area_status (areaID, survey_date, > > update_time, status ) VALUES (?,?,?,?)'); > > $dbh->execute('$values[0]', '$values[1]', '$values[2]