Forward Slash issue with DBI - perl

Question

I'm new to using DBI for SQL queries in a perl script. The issue I'm having pertains to data in fields that have a forward slash. I'm wanting to use variables as input for my where clause, but it is doing what DBI intends a forward slash to do: stop the query. I tried numerous different work arounds from binds, quotes, etc. but none worked, is it even possible? Data in this is consistent. The line with the my $sql variable is where the trouble is.
#!/usr/bin/perl
# Modules
use DBI;
use DBD::Oracle;
use strict;
use warnings;
# Connection Info
$platform = "Oracle";
$database = "mydb";
$user = "user";
$pw = "pass";
# Data Source
$ds = "dbi:Oracle:$database";
my $dbh = DBI->connect($ds, $user, $pw);
# my $dbh = DBI->connect();
my $XCOD = $dbh->quote('cba');
my $a = $dbh->quote('abc');
my $b = $dbh->quote('123');
# tried this as well my $pid = $dbh->quote('$a/$b');
my $sql = "SELECT P_ID FROM MyTable WHERE P_ID=$a/$b AND XCOD=$XCOD";
my $sth = $dbh->prepare($sql);
$sth->execute();
my $outfile = 'superunique.txt';
open OUTFILE, '>', $outfile or die "Unable to open $outfile: $!";
while(my #re = $sth->fetchrow_array) {
print OUTFILE #re,"\n";
}
close OUTFILE;
$sth->finish();
$dbh->disconnect();

Answer 1

I don't like to see folks use variable interpolation in SQL queries. Try using placeholders:
[ snip ]
my $P_ID = "$a/$b"
my $sql = "SELECT P_ID FROM MyTable WHERE P_ID = ? AND XCOD = ?";
my $sth = $dbh->prepare($sql);
$sth->execute($P_ID, $XCOD);
[ snip ]

Answer 2

You have been given the correct solution to your problem (use placeholders) but you might be interested to see why what you are doing doesn't work.
The problem is that you seem to misunderstand the quote method. The documentation says this:
Quote a string literal for use as a literal value in an SQL statement,
by escaping any special characters (such as quotation marks) contained
within the string and adding the required type of outer quotation
marks.
You use quote in these three lines.
my $XCOD = $dbh->quote('cba');
my $a = $dbh->quote('abc');
my $b = $dbh->quote('123');
It would be instructive to print out the values of $XCOD, $a and $b (as an aside $a and $b are really bad names for variables - apart from their non-descriptive nature, they are also special variables used in sorting).
I suspect that you'll see "cba", "abd" and "123". The method has found no special characters to escape, so all it has done is to add quote marks around the strings.
You then interpolate these values into your SQL.
my $sql = "SELECT P_ID FROM MyTable WHERE P_ID=$a/$b AND XCOD=$XCOD";
Again, you should take a close look at what $sql contains after this statement has been executed. It will look something like this:
SELECT P_ID FROM MyTable WHERE P_ID="abc"/"123" AND XCOD="cba"
It's probably the first part of the WHERE clause that is a problem. Oracle is treating that as a division. And who knows what Oracle does when you divide one string by another. So you end up looking for a row where P_ID is some strange (perhaps undefined) value.
So this looks to be an example where the simplest of debugging techniques (a few print statements in the code) would have guided you in the right direction.