DBI security tainting
 
 
- By default the DBI ignores Perl tainting
- 
- doesn't taint returned data
- doesn't check that parameters are not tainted
 
- 
- The Taint attribute enables that behaviour
- 
- If Perl itself is in taint mode
- 
 
- Each handle has it's own inherited Taint attribute
- 
- So can be enabled for particular connections and disabled for particular statements, for example:
 
- 
 $dbh = DBI->connect(…, { Taint => 1 });
 $sth = $dbh->prepare("select * from safe_table");
 $sth->{Taint} = 0;  # no tainting on this handle