# DBI security tainting

- ## By default the DBI ignores Perl tainting

  - doesn't taint returned data
  - doesn't check that parameters are not tainted

- ## The Taint attribute enables that behaviour

  - If Perl itself is in taint mode

- ## Each handle has it's own inherited Taint attribute

  - So can be enabled for particular connections and disabled for particular statements, for example:
- $dbh = DBI->connect(…, { Taint => 1 });
  $sth = $dbh->prepare("select * from safe_table");
  $sth->{Taint} = 0; # no tainting on this handle

## .

Previous slide | Next slide | Back to first slide | View graphic version