From: Brian Candler <b.candler@...>
Date: 2011-02-25T16:03:08+09:00
Subject: Re: Using CGI params with a MYSQL query

Sorry, my mistake; I saw "dbh" and drew the wrong conclusion.

The low-level mysql API doesn't have this convenience feature. You need 
to use Mysql.quote. e.g.

"insert into foo (bar) values '#{Mysql.quote(str)}'"

Although DBI works, I wouldn't recommend it for new application. It's a 
stale project and has very little care and attention these days.

I'd say most people are using one of these:
- ActiveRecord
- DataMapper
- Sequel

These all work at a much higher level, and handle quoting for you 
(amongst many other things). However, if you really have to write your 
application as as a CGI you may find the startup overhead is too high, 
especially with ActiveRecord. With CGI you have to fire up a new ruby 
interpreter *and* load in all the libraries you need, for every single 
incoming HTTP request; ActiveRecord is pretty huge and this can add one 
second or more to the request processing.

This isn't a problem when using any persistent framework - these days 
this normally means anything written on top of Rack, either running its 
own standalone webserver (webrick/mongrel/thin/unicorn/rainbows!), or 
inside Apache using Phusion Passenger. You start the app once, then it 
sits there processing requests one after the other.

Regards,

Brian.

-- 
Posted via http://www.ruby-forum.com/.