How to run several variables through a regexp?

Rather than doing it manually?

[MichaelBluejay]

I'm getting <FORM> data from visitors and sticking it into a MySQL database. Any ' or " marks in the input will break the INSERT code, so I need to escape those, which I'm doing like this:

$variable =~ s/'/\\'/g;
$variable =~ s/"/\\"/g;

That works fine except I don't want to have to have twenty sets of that code to process each of the 20 variables. Surely there's got to be a way to run this through a loop or something, right?

Thanks for your help, -MBJ-

[moltar]

That is not enough info. How do you read form data? What database you use and how do you store into it?

[billegal]

Search for perl loop on your favorite search engine.

Pseudo code looks something like:

for each form variable,
perform the following changes.

[SeanW]

For one, look at DBI::quote. I also think it gets taken care of if you prepare() and execute() the statement:

my $sth = $dbh->prepare("INSERT INTO foo (c1) VALUES (?)");
$sth->execute("Isn't this OK?");

This assumes you're using DBI.

Sean

[WWMike]

Parse the form into an array like below and add any additional processing in that loop or perform a separate loop to further process that array later on:

read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'});
@pairs = split(/&/, $buffer);
foreach $pair (@pairs) {
($name, $value) = split(/=/, $pair);
$value =~ tr/+/ /;
$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
$value =~ s/~!/ ~!/g;
$form{$name} = $value;
}