The other main reason NOT to interpolate is for security reasons.
If the interpolation value is user supplied, and you have a untrustworthy user 
base, you are vulnerable from "SQL injection attacks".  Do a search on that 
subject if you need more background information.

 


-----Original Message-----
From: Jason Friedman [mailto:[EMAIL PROTECTED]
Sent: Thursday, February 09, 2006 9:22 AM
To: [email protected]
Subject: RE: mysql problem


        my $sth = $dbh->prepare("SELECT * FROM logs where datetime like '?'")
           or die $dbh->errstr;
                print "Enter datetime: ";
                while ($datetime = <>) {
                   my @data;
                           chomp $datetime;
                                   $sth->execute($datetime) or die $sth->errstr;

then I am prompted to enter a date, which I can, but immediately after
that:

DBD::mysql::st execute failed: called with 1 bind variables when 0 are
needed at datetime.pl line 19, <> line 1.

>> I've seen this, too.  You might try using a naked ? without the single 
>> quotes.

If I define $datetime beforehand and interpolate it in the query, it
works, but I read here that it is not reccommended:

>> True that it's not recommended, because for each iteration the query will 
>> need to be re-parsed, but if you are not executing this query a million 
>> times, it probably won't matter much.


Attachment: Brian Campbell (E-mail).vcf
Description: Binary data

Reply via email to