CGI Form Validation

How to validate a form a perl-cgi

[mrfori]

Hi guys,

I am using a perl cgi to insert data in a mysql DB. It works good but if the data included '," or ; it doesnt insert ..

how would you validate the entries?

thanks a lot

[jeremy goodrich]

Write a regex to check what kind of data is being passed to your script.

Eg
$mydata =~ s/,//ig;

Something like that - just do global replace for the characters you don't want with nothing, which is what I do on some validation for scripts.

[sugarkane]

Or try using the quote() method of the DBI module - eg:

$string=$dbh->quote("$string");

That should clear up problems relating to unescaped 'special' characters that might be confusing MySQL

[Storyteller]

If you need to insert/update several fields, you may also want to look into variable binding to avoid $dbh->quote clutter:

$dbh->do('INSERT INTO orders SET item =?, price =?', undef, $item, $price);