OWASP Top Ten - A1 Injection - Good/Bad - In Perl

bad.psgi

use v5.16; 

use Plack::Request; 

my $app = sub { 
    # Plack::Request makes getting parameters easier 
    my $req = Plack::Request->new(shift); 

    # Load the name 
    my $name = $req->parameters->{name}; 

    # BAD BAD BAD Embed the name into the SQL 
    my $foo = $dbh->selectrow_hashref( 
        "select stuff from foo where name = '$name'");

    # Return the result 
    return [  
        200,  
        [ 'Content-type' => 'text/plain' ],  
        [ $foo->{stuff} ]  
    ]; 
};

good.psgi

use v5.16; 

use Plack::Request; 

my $app = sub { 
    # Plack::Request makes getting parameters easier 
    my $req = Plack::Request->new(shift); 

    # Load the name 
    my $name = $req->parameters->{name}; 

    # Bind the name to the SQL query 
    my $foo = $dbh->selectrow_hashref( 
        "select stuff from foo where name = ?", undef, $name);

    # Return the result 
    return [  
        200,  
        [ 'Content-type' => 'text/plain' ],  
        [ $foo->{stuff} ]  
    ]; 
};