Developer's Guide to Web Application Security

error_page();

}else{

# set up our statement, we know everything is OK since the

# values are present.

NOTE

Normally I’d filter the input here, but since CGI programming is the topic

of another chapter, and since not everyone is familiar with Perl regular

expression syntax, I’ll omit that step.

my $statement = "UPDATE demo

SET email = '$email',

name = '$name',

phone = '$phone',

paragraph = '$paragraph'";

my $dbh = DBI->connect('DBI:mysql:demo', 'user');

# turns our string into a query

my $sth = $dbh->prepare($statement);

# execute our query, terminate upon error

$sth->execute

or die $sth->errstr;

# clean up after ourselves with the next two statements

$sth->finish; ...