Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations bkrike on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

DBI query.

Status
Not open for further replies.

tar565

Programmer
Jan 24, 2005
39
IE
I have data stored in 2 variables $Execution_Time and $Description.

I am trying to write the data into a table emails as follows:

$dbh->do('INSERT INTO Emails (ID, date_entered, description, deleted) VALUES ("1", "$Execution_Time", "$Description","0")');

but the word description is written into the field and the date is written as default.

 
Should you be using single quotes instead of double quotes for strings?
 
Because your string is single-quoted, those variables aren't going to be interpolated, so the literal strings `$Execution_Time' and `$Description' are going to be inserted into your database. In any event, you should (for the sake of both security and ease of use) be using prepared statements and placeholders for this.

Untested example (may not compile):
Code:
$sth = $dbh->prepare( 'INSERT INTO Emails (ID, date_entered, description, deleted) VALUES( ?, ?, ?, ?)' );
$sth->execute( 1, $Execution_Time, $Description, 0 );

Basically, in the first line, you're using placeholders (the ? signs) to show DBI where you want to insert variables when you execute the statement. DBI will then automatically quote your parameters correctly when you pass them as arguments to execute().

For more reasons why to use placeholders, read this.
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top