CODEWITHSUNDEEP
mysqlperl
user391986
user391986

Reputation: 30956

should I escape code stored in mysql db or use placeholders?

I just found out about placeholders in DBI https://metacpan.org/pod/DBI#Placeholders-and-Bind-Values and it seems to be handling various codes pretty well. Should I be forcing escape regardless? Are there any scenarios where the placeholders would fail based on the input?

Upvotes: 1

Views: 195

Answers (1)

Dondi Michael Stroma
Dondi Michael Stroma

Reputation: 4800

If you escape them and then use bound placeholders, they will end up double escaped, which is not what you want. Just use placeholders. (I frequently use them even when the input is trusted, because it looks cleaner.)

There is rarely a reason to use escaping instead of placeholders. An example would be dynamically generating and manipulating a query as an SQL string, but you really shouldn't do that anyway (there are plenty of libraries on CPAN for generating SQL).

The only example that I know of in which a placeholder would fail based on input that would not fail with string interpretation would be when you are interpolating column names from a string, LIMIT clauses, or some such (but again, that is dynamic generating SQL like I mentioned above.)

Placeholders >> manual escaping

Upvotes: 4

Related Questions