how to pass variable value to a sql query

[Pradeepta Swain]

Hi,
How can i pass a variable to a sql query like

rs = dbh.prepare("select *from status_check where id=204")
rs.execute

Instead of giving the value of id I want to make it dynamic ,where I can
pass the dynamic value of id fetched from database much like in PL/SQL .
How to do this .Anybody help !!

 

[David Morton]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
How can i pass a variable to a sql query like

rs = dbh.prepare("select *from status_check where id=204")
rs.execute

Instead of giving the value of id I want to make it dynamic ,where I
can
pass the dynamic value of id fetched from database much like in PL/
SQL .
How to do this .Anybody help !!

look up "placeholders". A google search yielded: http://www.kitebird.com/articles/ruby-dbi.html#TOC_8


David Morton
Maia Mailguard http://www.maiamailguard.com
(e-mail address removed)



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)

iD8DBQFHew7gUy30ODPkzl0RAsIKAJ4kBWKmfTmF0k083dj2yAIK+4ZsrgCeOHWV
iqgUQG+oXnKiR0ZBH8NyEHQ=
=eXia
-----END PGP SIGNATURE-----

 

[Karthi kn]

Hi,
How can i pass a variable to a sql query like

rs = dbh.prepare("select *from status_check where id=204")
rs.execute

Instead of giving the value of id I want to make it dynamic ,where I can
pass the dynamic value of id fetched from database much like in PL/SQL .
How to do this .Anybody help !!

rs = dbh.prepare("select *from status_check where id=#{value}")
rs.execute

 

[David Morton]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

rs = dbh.prepare("select *from status_check where id=#{value}")
rs.execute

NO! This is a security risk.

This opens you up to sql injection attacks. You should always use
placeholders so the library can properly escape your input. See my
other message for a link on how to use placeholders.

David Morton
Maia Mailguard http://www.maiamailguard.com
(e-mail address removed)



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)

iD8DBQFHezjOUy30ODPkzl0RAtFmAJ4qoogCOpMZk+gWRbwGUL08OtTzKwCgiQm6
HWDyvWfx2dhMYYvHKbme4ZA=
=2tT+
-----END PGP SIGNATURE-----