DBI security tainting
By default the DBI ignores Perl tainting
- doesn't taint returned data
- doesn't check that parameters are not tainted
-
The Taint attribute enables that behaviour
- If Perl itself is in taint mode
-
Each handle has it's own inherited Taint attribute
- So can be enabled for particular connections and disabled for particular statements, for example:
-
$dbh = DBI->connect(…, { Taint => 1 });
$sth = $dbh->prepare("select * from safe_table");
$sth->{Taint} = 0; # no tainting on this handle