Hi, I am just wondering how to have safe parameters avoiding to use
parametrized queries. How behaves quote_literal against sql injection
attempts? Is it adequate or must we use something stronger? Like for
example (Perl):

sub sanitize{
my $p=shift;
$p=~ s/[\\"'\*\#]+//g;
$p=~ s/-+/-/g;
return $p;
}

particularly I am wondering how quote_literal behaves against sql remarks.

have fun:
http://xkcd.com/327