| Subject: | DBD::PgPP bug: literal question marks replaced with "NULL" |
| Date: | Fri, 01 Feb 2008 14:07:58 -0800 |
| To: | bug-DBD-PgPP [...] rt.cpan.org |
| From: | Kevin Beverly <kbeverly [...] scharp.org> |
hi,
i want to alert you to a bug in the DBD::PgPP module: literal question
marks in sql INSERT statements are being replaced with the word "NULL".
this happens in the execute method on line 360 of PgPP.pm where the
module substitutes parameters for question marks regardless of whether
or not any parameters have been supplied:
for (my $i = 0; $i < $num_param; $i++) {
my $dbh = $sth->{Database};
my $quoted_param = $dbh->quote($params->[$i]);
$statement =~ s/\?/$quoted_param/e;
}
since escaping of question marks is not handled by the "quote" method,
something has to happen at this point to insure that literal question
marks are not replaced with non-existent parameters.
this was my fix:
# EDIT by Kevin Beverly 02/01/2008
if ( @$params > 0 ) {
for (my $i = 0; $i < $num_param; $i++) {
my $dbh = $sth->{Database};
my $quoted_param = $dbh->quote($params->[$i]);
$statement =~ s/\?/$quoted_param/e;
}
}
thanks,
kevin
--
*******************************************************************
Kevin Beverly
Systems Analyst/Programmer
SCHARP / HIVNET Statistical Center
1100 Fairview Ave. North, LE-400
P.O. Box 19024
Seattle, WA 98109-1024
E-mail: kbeverly@scharp.org
Phone: 206-667-6991
Fax: 206-667-4812
*******************************************************************
CONFIDENTIALITY NOTICE: This e-mail message and any attachments may be
confidential and privileged. If you are not intended to receive this
message, please notify the sender and destroy the message. Thank you.