Alex:

See DBI(3) for details on the quote and do methods. I printed out the whole
thing and find it very helpful.

perldoc DBI

In the first instance the prepare method: $query = $db->prepare("SELECT 'member_id','username','password' FROM profiles where username=\'$post{'username'}\'");

is the same method as: $query = $db->prepare("SELECT 'member_id','username','password' FROM profiles where username=$post{'username'}");

Just the statement is different. Thus, just as the me@hotmail needs to be
written as me\@hotmail now, you still would need, I think, to have $post{'username'}
written as \'$post{'username'}\' ... as the way it is quoted inside the prepare statement
is independent of its value.

Also, you change the value of $post{'username'} with the $db->quote method. And
still expect the:

if (($result->[1] eq $post{'username'}) && ($result->[2] eq $post{'password'}))

to work the same even though the $post{'username'} value is somewhat different
than you expect.

Always, if possible, assign values to new scalars, etc., and then work on the
copies, unless it is too cumbersome, or you really need/want to. That way you can always
get back to your original value.

I'm no expert, however, making your SQL statement in advance is simpler...

$SQLstatement = "SELECT member_id, username, password FROM profiles where username=".$post{'username'};

print $SQLstatement."\n" if $debug; #to make sure it looks right

unless ($debug) { $db->quote($SQLstatement); $query = $db->prepare($SQLstatement); $query->execute; ...

$query->finish; }

If I'm out to lunch, sorry!

Alec Smith wrote: