DBI security tainting
 
 
- By default DBI ignores Perl tainting
- 
- doesn't taint database data returned ‘out’ of the DBI
- doesn't check that parameters passed ‘in’ to the DBI are not tainted
 
- 
- The TaintIn and TaintOut attributes enable those behaviours
- 
- If Perl itself is in taint mode.
- 
 
- Each handle has it's own inherited tainting attributes
- 
- So can be enabled for particular connections and disabled for particular statements, for example:
 $dbh = DBI->connect(…, { Taint => 1 }); # enable TaintIn and TaintOut
 $sth = $dbh->prepare("select * from safe_table");
 $sth->{TaintOut} = 0;  # don’t taint data from this statement handle
 
- Attribute metadata currently varies in degree of tainting
- 
$sth->{NAME};	 — generally not tainted
 
 $dbh->get_info(…);	 — may be tainted if the item of info is fetched from database