How to insert text into mysql having quotes using perl

Question

How to insert text into mysql having quotes using perl ? It seems difficult to insert text containing ' & ". I'm using Perl DBI module & DB is mysql.

UPDATE:

here is my query

my $s = "INSERT INTO comment(guid,review_id) VALUES ('$guid','$review_id')";

Answer 1

You should read section 'Placeholders and Bind Values' in man DBI

EDIT: added example

my $s = "insert into comment(guid,review_id) values (?, ?)";
$dbh->do( $s, undef, $guid, $review_id) or die $dbh->errstr;

Answer 2

Your old query would have been something like this:

my $s = "insert into comment(guid,review_id) values ('$guid','$review_id')";
$dbh->do($s);

The better way, using placeholders and bind values as per @AlexD's answer, would look like this:

my $sth = $dbh->prepare("insert into comment(guid,review_id) values (?, ?)";);
$sth->execute($guid, $review_id);

To learn about the security risks of your first approach, have a look at SQL injection attacks on Wikipedia.