Question

I need to manipulate some records in a DB and write their values to another table. Some of these values have an ‘&’ in the string, i.e. ‘Me & You’. Short of finding all of these values and placing a \ before any &’s, how can insert these values into a table w/o oracle choking on the &?

Answer 1

Use placeholders. Instead of putting '$who' in your SQL statement, prepare with a ? there instead, and then either bind $who, or execute with $who as the appropriate argument.

my $sth = $dbh->prepare_cached('INSERT INTO FOO (WHO) VALUES (?)');
$sth->bind_param(1, $who);
my $rc = $sth->execute();

This is safer and faster than trying to do it yourself. (There is a “quote” method in DBI, but this is better than that.)