PERL and HTML

[848lu]

hi, i have this code (below), and i wanted to take values from a webpage instead of it directly inserting values, how would i do that?

im sure i have to use REQUEST or something, but not sure how to do it, pleaaaseeee help...thanks

 
my $dbh = DBI->connect("dbi:Oracle:ORA8", "username","password")
        or die "Cannot connect: " .  $DBI::errstr;
$dbh->do("INSERT INTO Student (StudentID, FirstName, LastName, DateOfBirth, Coursecode) VALUES (1234,'Josephine', 'Williams', TO_DATE('02-Feb-1980'),'2COS6')")
        or die "Cannot do: " . $dbh->errstr();
 
$dbh->disconnect();
 

[eWish]

Have a look at the DBI documentation for "Placeholders and Bind Values".

Also, this really looks like homework/schoolwork/coursework. Please read our Posting Guidelines regarding Homework.

--Kevin

[numberwhun]

Have a look at the DBI documentation for "Placeholders and Bind Values".

Also, this really looks like homework/schoolwork/coursework. Please read our Posting Guidelines regarding Homework.

--Kevin

It may or may not be, but I am more wondering how closely related this and his other question regarding Perl and Oracle are. If they ARE the same project, why not just ask them both in the same thread?

If you want Kevin, go ahead and merge the two if they seem too closely related.

[848lu]

oh sorry, im really bad with all these stuff as in forums and all that...

but yeah their not realted so....

but thanks next time ill keep in mind

[numberwhun]

oh sorry, im really bad with all these stuff as in forums and all that...

but yeah their not realted so....

but thanks next time ill keep in mind

You say that they are not related, yet they look to be the same project. Am I correct in this assessment? If they are, you can probably include them together in the same thread to get them answered. There is nothing stating you can't ask two or more questions in a thread, especially if they relate to the same project you are working on.

Regards,

Jeff

[eWish]

Essentially, you take your incoming form data and untaint it (which is not shown here) then you assign it to a variable and if the value is not defined, then the new value will be undef. Which will keep the placholders from breaking the code if the values are not defiend.

my $StudentID = $q->param('StudentID') || undef;
my $FirstName = $q->param('FirstName') || undef;
my $LastName  = $q->param('LastName')  || undef;
my $DateOfBirth = $q->param('DateOfBirth') || undef;
my $Coursecode  = $q->param('Coursecode') || undef;

Then do an insert statement as shown. There must be equal number of Placholders (?) as you do values. Placeholders will automatically escape your data for you.

my $insert = $dbh->prepare(q{INSERT INTO Student(StudentID, FirstName, LastName, DateOfBirth, Coursecode) VALUES (?,?,?,?,?)});
   $insert->execute($StudentID, $FirstName, $LastName, $DateOfBirth, $Coursecode);
   $insert->finish();

If you have any problems then please post back.

--Kevin

[848lu]

Essentially, you take your incoming form data and untaint it (which is not shown here) then you assign it to a variable and if the value is not defined, then the new value will be undef. Which will keep the placholders from breaking the code if the values are not defiend.

my $StudentID = $q->param('StudentID') || undef;
my $FirstName = $q->param('FirstName') || undef;
my $LastName  = $q->param('LastName')  || undef;
my $DateOfBirth = $q->param('DateOfBirth') || undef;
my $Coursecode  = $q->param('Coursecode') || undef;

Then do an insert statement as shown. There must be equal number of Placholders (?) as you do values. Placeholders will automatically escape your data for you.

my $insert = $dbh->prepare(q{INSERT INTO Student(StudentID, FirstName, LastName, DateOfBirth, Coursecode) VALUES (?,?,?,?,?)});
   $insert->execute($StudentID, $FirstName, $LastName, $DateOfBirth, $Coursecode);
   $insert->finish();

If you have any problems then please post back.

--Kevin

Thanks a lot mate, what do you mean by untaint?

ok this is what i will do after looking at the code you gave me, i will make a html file which obviously has a form with post, and then add

my $StudentID = $q->param('StudentID') || undef;
my $FirstName = $q->param('FirstName') || undef;
my $LastName  = $q->param('LastName')  || undef;
my $DateOfBirth = $q->param('DateOfBirth') || undef;
my $Coursecode  = $q->param('Coursecode') || undef;

to store my values into a variable.
so does that mean i dont have to use _REQUEST on my perl program?

and what is $q->param in the code? because i have to explain it in my project.
thanks.

[KevinADC]

the param() function is a function of the CGI modules standard interface. Read the CGI documentation for implementation and general information:


http://perldoc.perl.org/CGI.html

[eWish]

I am using the CGI.pm to get the values of the various fields.

#create a CGI object.
my $q = CGI new;
 
#get the various params using CGI.pm
# This would be the value entered into the textfield named "field1"
$q->param('field1'); 
 
#The undef is telling it to be undefined and enter a null value into the database if the field is empty or left blank.
$q->param('field1')  || undef;
 
#This assigns it to a variable that can be used in the script elsewhere
my $variable =  $q->param('field1')  || undef;

To help you learn more read the documentation about the CGI.pm and also check out the http://perldoc.perl.org/5.8.8/]perldocs for about perl.

When trying to learn CGI scripts using perl this site is helpful.

--Kevin

[eWish]

As for the "What is untaint?" checkout perlsec. Here is an example of untaintaing data using a regex.

my $var;
 
if ( $q=>param('var') =~ /^(?:([\w\s+\d\']+))$/) {
     $var = $1;
}
 
print $var;

When in taint mode perl treats incoming data as tainted and untrustworthy. Therefore, you must check to make sure that the data is what you are expecting it to be based on the regex in this case. Taint mode is turned on my using the -T on the first line after the path to perl.

--Kevin

[848lu]

hi yall...thanks for helping me out


i have thoguth about what you guys have commented, but wasnt able to get it to work, but i have done this so far and it works fine and it add data ro my database, so if anyone can help me to add all the commenets made about

my $dbh = DBI->connect("dbi:Oracle:ORA8", "username","password")
        or die "Cannot connect: " .  $DBI::errstr;
$dbh->do("INSERT INTO Student (StudentID, FirstName, LastName, DateOfBirth, Coursecode) VALUES (1234,'Josephine', 'Williams', TO_DATE('02-Feb-1980'),'2COS6')")
        or die "Cannot do: " . $dbh->errstr();
 
 

and when i add this bit below, i get error messgas of the variables

my $StudentID = $q->param('StudentID') || undef;
my $FirstName = $q->param('FirstName') || undef;
my $LastName  = $q->param('LastName')  || undef;
my $DateOfBirth = $q->param('DateOfBirth') || undef;
my $Coursecode  = $q->param('Coursecode') || undef;

[eWish]

Well, we will need two things, the code that is producing the errors and the errors them self. If your code is not to long post it here and we can take a look at it for you.

I would have to assume it is because you are not using the CGI.pm and the code I gave you is.

--Kevin

[848lu]

Well, we will need two things, the code that is producing the errors and the errors them self. If your code is not to long post it here and we can take a look at it for you.

I would have to assume it is because you are not using the CGI.pm and the code I gave you is.

--Kevin

yes i am using CGI, just now i got error saying that theres a internal server error, so i asked me lecturer to look into and then i will post the errors that i get of the codes.


thanks