3 ms·
I’m not terribly familiar with Perl. Will that interpolate at string creation, or is that just text in a string that the db driver will later do parameter bindi
by azinman2 4y ago
I’m not terribly familiar with Perl. Will that interpolate at string creation, or is that just text in a string that the db driver will later do parameter bindings with?
- AnimalMuppet 4y agoNo, Perl strings are interpolated at creation.
- Areading314 4y agoThis is a classic SQL injection bug/security flaw
- Areading314 4y agoIronic since I always thought one of the coolest features in perl was taint analysis, which allows keeping track of all unparsed user input: https://www.geeksforgeeks.org/perl-taint-method/#:~:text=Taint%20mode%20is%20used%20to%20keep%20track%20of,any%20data%20that%20comes%20from%20outside%20the%20code https://www.geeksforgeeks.org/perl-taint-method/#:~:text=Tai....
- tyingq 4y agoYes, it will interpolate. The DBI package he's using does support parameter bindings with a ? character. He's just doing it wrong.