Perl SQL injection

[Ejdaha]

Hi all. Can someone demonstrate for me a basic SQL injection in Perl and how I can avoid from it. And can someone advice me a book or document about Perl Security?

Thanks...

[fireartist]

How to avoid it: make sure you use placeholders, e.g.

# DON'T do this
my $sth = $dbh->prepare("SELECT * FROM users WHERE id = '$id'");

$sth->execute();

# DO THIS
my $sth = $dbh->prepare('SELECT * FROM users WHERE id = ?');

$sth->execute( $id );

Perl Security (http://perldoc.perl.org/perlsec.html) (although it doesn't address databases)

[Ejdaha]

OK, thank you very much