$dbh->do("INSERT INTO t (col1, ...) SELECT col1, ... FROM t2 WHERE x = '$element'");

Oi SQL injection warning! Red lights and sirens - don't do that!!

'$element' is suuuuupper dangerouse, evil evil evil

either $dbh->quote it or use ? in your prepare/execute dance:

$dbh->do( 'INSERT INTO t (col1,col2) SELECT col1,col2 FROM t2 WHERE x = ' . $dbh->quote($element) );

Lee.M

Reply via email to