DBI security tainting
By default the DBI ignores Perl tainting
- doesn't taint returned database data
- doesn't check that parameters are not tainted
-
The Taint attribute enables that behaviour
- If Perl itself is in taint mode
-
Each handle has it's own inherited Taint attribute
- So can be enabled for particular connections and disabled for particular statements, for example:
$dbh = DBI->connect(…, { Taint => 1 });
$sth = $dbh->prepare("select * from safe_table");
$sth->{Taint} = 0; # no tainting on this statement handle
Attribute metadata currently varies in degree of tainting
$sth->{NAME}; — generally not tainted
$dbh->get_info(…); — may be tainted if the item of info is fetched from database