mysql placeholder not working for DATE_ADD (perl) - mysql

Question

I really appreciate your help on my last question. This is related but I didn't want to hide this question inside the other.. I'm having a problem using "DATE_ADD(NOW(), INTERVAL $interval)" inside a placeholder. Before I was using placeholders this line worked just fine, not it comes back as empty.
$store = qq(INSERT INTO main (creator_name,relationship,time) VALUES(?,?,?) );
my $sth = $dbh->prepare($store);
$sth->execute($data{creatorname},$data{relationship}, "DATE_ADD(NOW(), INTERVAL $interval)");
Is there another way to add DATE_NOW so it's synatically proper? I tried adding it back in like
$store = qq(INSERT INTO main (creator_name,relationship,time) VALUES(?,?, DATE_ADD(NOW(), INTERVAL $interval)) );
and it errored out saying the syntax was wrong. At least with the code on the top it executes, it just leaves the value empty. With this attempt it won't even try.

Answer 1

Would you expect the following to print ABC?
$x = 'uc "abc"';
print $x;
No, that would make no sense. Same thing in SQL.
The string DATE_ADD(NOW(), INTERVAL ...) is surely not a valid value for the time field.
it errored out saying the syntax was wrong.
I'm pretty sure the message was more specific than that. You also didn't provide the value of $interval, without which we have no way of knowing what resulted in a syntax error.

Answer 2

Changing your qq() to qq{} for clarity, this should be the fix:
$store = qq{
INSERT INTO main (creator_name,relationship,time)
VALUES(?, ?, DATE_ADD(NOW(), INTERVAL ? SECOND) )
};
my $sth = $dbh->prepare($store);
$sth->execute($data{creatorname},$data{relationship},$interval);
You'll need to change the word "SECOND" to the appropriate units, and $interval needs to be an integer.
Kudos for using prepared statements, but the reason why this doesn't work the way you tried it is very important: placeholders ? are not simply places where arbitrary text will be substituted into your query. This is why we make such a big deal about the importance of using prepared statements as one way to protect against sql injection. Placeholders are a hard delineation between "what is the query" and "what is the data" and they are sent to the server separately, not munged together.
Thus...
my $sth = $dbh->prepare(qq{SELECT * FROM user WHERE username = ? AND password = ?});
$sth->execute("hacker", "' OR 1 = 1; --");
...cannot be misinterpreted to become the dreaded...
SELECT * FROM user WHERE username = 'hacker' AND password = '' OR 1 = 1; --'
...when done in a prepared statement, as it would if you constructed your query with primitive string concatenation, because the server will never be confused between the two.
A placeholder substitutes exactly one scalar literal value, which "DATE_ADD(NOW(), INTERVAL $interval)" isn't. (Yes, it's a scalar string in Perl, but it contains an expression, not a literal value).