mysql - 使用perl将特殊字符插入mysql

Question

嗨，我对 Perl 很陌生。 我有一个像这样的 temp_data.txt 文件

Id    Comments
--------------------------------
1      this is a 'comment'
2      special comment
3      user comment 'user'
-----------------------------------


  open (MYFILE, 'temp_data.txt');
while (<MYFILE>) {
if($_=~/^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(.+)/)
{
    $id=$1;    
    $comment = $2;
}

while(<MYFILE>)
{
    $line=$_;
    if($line=~/^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(.+)/)
    {
        seek(MYFILE, -length($_), 1);
        last;
}
    else
    {           if($_=~/\s*(.*)/)
        {
            $comment .=$1;

        }
    }
}

my $queryString = "INSERT INTO Headline (id,comment) VALUES ('$id', ' $comment')";

$sth = $dbh->prepare($queryString);
$sth->execute() or die $DBI::errstr;
$sth->finish();
}

但是在插入数据库时​​如果遇到特殊字符会抛出这样的错误。

DBD::mysql::st execute failed: You have an error in your SQL syntax; 
check the manual that corresponds to your MySQL server version for the right syntax to use near 'comment')' at line 1 at head.pl line 1.

有人能帮我吗？ 提前致谢

Answer 1

也许，您要插入的数据具有特殊符号。为此使用参数化查询(它将保护您免受 SQL 注入(inject)):

my $queryString = "INSERT INTO Headline (id,comment) VALUES (?, ?)";

$sth = $dbh->prepare($queryString);
$sth->execute($id, $comment) or die $DBI::errstr;
$sth->finish();