[wordcompletition] sql placeholder

diff --git a/scripts/wordcompletition.pl b/scripts/wordcompletition.pl
index d08ae03407214dfcb731faa572d6cbd231ced7f9..6dfeb4ab4b10ab1423177831e0fc3f9dc5b23cfe 100644 (file)
--- a/scripts/wordcompletition.pl
+++ b/scripts/wordcompletition.pl
@@ -35,9 +35,9 @@ sub wordsearch
        my $sw = shift;
        my @retar;
        my $i = 0;
-       $query = qq{ select word from words where word like "$sw%" order by prio desc };
+       $query = qq{ select word from words where word like ? order by prio desc };
        $sth = $dbh->prepare ( $query );
-       $sth->execute();
+       $sth->execute($sw.'%');
        while (@ary = $sth->fetchrow_array ())
        {
                push @retar,$ary[0];
@@ -49,9 +49,9 @@ sub wordfind
 {
        my $sw = shift;
        my $ret;
-       $query = qq{ select word from words where word = "$sw" };
+       $query = qq{ select word from words where word = ? };
         $sth = $dbh->prepare ( $query );
-        $sth->execute();
+        $sth->execute($sw);
         @ary = $sth->fetchrow_array;
         $ret = join ("", @ary), "\n";
         $sth->finish();
@@ -61,25 +61,25 @@ sub wordfind
 sub wordupdate
 {
        my $sw = shift;
-       $query = qq { update words set prio = prio + 1 where word = "$sw" };
+       $query = qq { update words set prio = prio + 1 where word = ? };
         $sth = $dbh->prepare ( $query );
-        $sth->execute();
+        $sth->execute($sw);
         $sth->finish();
 };
 sub delword
 {
        my $sw = shift;
-       $query = qq { delete from words where word = "$sw" };
+       $query = qq { delete from words where word = ? };
         $sth = $dbh->prepare ( $query );
-        $sth->execute();
+        $sth->execute($sw);
         $sth->finish();
 };
 sub addword
 {
        my $sw = shift;
-       $query = qq { insert into words values ('$sw', 1) };
+       $query = qq { insert into words values (?, 1) };
         $sth = $dbh->prepare ( $query );
-        $sth->execute();
+        $sth->execute($sw);
         $sth->finish();
 };
 sub word_complete