From: Hassan Schroeder <hassan.schroeder@...>
Date: 2011-02-24T09:32:14+09:00
Subject: Re: Using CGI params with a MYSQL query

On Wed, Feb 23, 2011 at 4:21 PM, Doug Al <douga@cachecomm.com> wrote:
> I am feeding CGI params to my program for testing purposes from the
> keyboard, then using this value to build a MYSQL query.

> The problem I am having is when using #{myparamvariable}, the MYSQL
> query fails it seems because the query is seeing [" "] (brackets) around
> the variable.
>
> I am grabbing the CGI param as follows:
>
> myparamvariable=params['mycgiparam']

What happens if you log that value (or break into debug) immediately after?
And what does the query in the MySQL log look like?

> my query is as follows:
>
> result= dbh.query ("
> SELECT *
> FROM mytable
> WHERE myfield= #{myparamvariable}
> ")

Auwe! -- <http://xkcd.com/327/> -- c.f. "prepared statements"  :-)

-- 
Hassan Schroeder ------------------------ hassan.schroeder@gmail.com
twitter: @hassan