Received: from localhost (postgresql.org [64.49.215.8]) by postgresql.org (Postfix) with ESMTP id 3548D475DBD for ; Tue, 26 Nov 2002 13:47:21 -0500 (EST) Received: from bast.unixathome.org (bast.unixathome.org [66.11.174.150]) by postgresql.org (Postfix) with ESMTP id 5C3CC475B99 for ; Tue, 26 Nov 2002 13:47:20 -0500 (EST) Received: from wocker (wocker.unixathome.org [192.168.0.99]) by bast.unixathome.org (Postfix) with ESMTP id 215223F4B; Tue, 26 Nov 2002 13:47:20 -0500 (EST) From: "Dan Langille" To: dave_h4@yahoo.com Date: Tue, 26 Nov 2002 13:47:20 -0500 MIME-Version: 1.0 Subject: Re: escape single quote in INSERT command Cc: Message-ID: <3DE37B68.8450.D898B9D8@localhost> In-reply-to: <47269.203.145.129.4.1038335486.squirrel@mail.trade-india.com> References: <27ad91d2.0211220500.19633b93@posting.google.com> X-mailer: Pegasus Mail for Windows (v4.02a) Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Content-description: Mail message body X-Virus-Scanned: by AMaViS new-20020517 X-Archive-Number: 200211/406 X-Sequence-Number: 10548 On 27 Nov 2002 at 0:01, mallah@trade-india.com wrote: > > Hi Group - > > > > I have a perl application for a registration form. > > Same Here, > > Why dont' you use prepare and execute in case you are using DBI > same program is like this. > > $dbh = DBI -> connect ( "......"); > $sth = $dbh -> prepare("insert into tab (a,b) values (?,?)"); > $sth -> execute($a , $b ); > $sth -> finish(); > $dbh -> commit(); > $dbh -> disconnect(); IIRC, there is a dbi->quote() function as well. That should properly escape anything. -- Dan Langille : http://www.langille.org/