working perl ascript now says .DBD::mysql::db do failed: You have an error in your SQL syntax;

Question

I got this perl script and it used to work fine till recently. i am getting this error message.

DBD::mysql::db do failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' '') ON DUPLICATE KEY UPDATE value=''' at line 2 at import_productfeatures.pl line 71. DBD::mysql::db do failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL serve r version for the right syntax to use near ' '') ON DUPLICATE KEY UPDATE value=''' at line 2 at import_productfeatures.pl line 71.

foreach my $feature (@features) {
    my $cat_featureid = $feature->{CategoryFeature_ID};
    my $value = $feature->{Presentation_Value};
    my $sql = "INSERT INTO products_features (product_id, feature_id, value) 
        VALUES (".$prodid.", ".$cat_featureid.", ".$dbh->quote($value).") 
        ON DUPLICATE KEY UPDATE value=".$dbh->quote($value);
    $dbh->do($sql);
  }

Answer 1

You should use placeholders, instead of putting the values directly into the string:

my $sql = "INSERT INTO products_features (product_id, feature_id, value) 
   VALUES (?,?,?) 
   ON DUPLICATE KEY UPDATE value=?";
my $sth = $dbh->prepare($sql);

foreach my $feature (@features) {
    my $cat_featureid = $feature->{CategoryFeature_ID};
    my $value = $feature->{Presentation_Value};

    $sth->execute($prodid,$cat_featureid,$value,$value);
}

$sth->finish();

DBI will handle the correct escaping for you.

Answer 2

Print out the value of $sql so you can see the SQL statement that you are building. Then you can see what the syntax problem is, or post it here so we can diagnose it.

However, even more than that, you should be using parametrized queries, not building SQL statements with untrusted external data. You are leaving yourself open to SQL injection. Please see http://bobby-tables.com/perl.html for examples on how to do it properly.

Answer 3

I think u missed single quote.

change

my $sql = "INSERT INTO products_features (product_id, feature_id, value) 
        VALUES (".$prodid.", ".$cat_featureid.", ".$dbh->quote($value).") 
        ON DUPLICATE KEY UPDATE value=".$dbh->quote($value);

to

my $sql = "INSERT INTO products_features (product_id, feature_id, value) 
        VALUES (".$prodid.", ".$cat_featureid.", '".$dbh->quote($value)."') 
        ON DUPLICATE KEY UPDATE value='".$dbh->quote($value."'");