5

I have a perl object (reference to array of references) like the below:

my $a = [ [$a, $ab, $c ], [$a, $b, $c] ] ;

and need to store it on the DB then retrieve it.

Could someone suggest a good mechanism to serialize even to compress it and then store it on the DB? Then deserialize it and use it in the code?

3 Answers 3

7

You may use any of the known serializers, e.g. JSON::XS or Storable. Storable is better if you want to retrieve references as references, not as copies of values. Then save a serialized object in the field of any type (VARCHAR, BLOB, ...) that satisfy storage requirements.

use Storable qw(nfreeze thaw);
use DBI;

# ... connect to database
# Store
my $data = [ [$a, $b, $c ], [ $a, $b, $c ] ];
my $bytestream = nfreeze $data;
$dbh->do('insert into table (field) values(?)', undef, $bytestream);

# Retrieve
$bytestream = $dbh->selectrow_array('select field from table where ...');
$data = thaw $bytestream;

Additionally, you can compress $bytestream, for example, via IO::Compress::Gzip

my $bytestream = gzip nfreeze $data;
5
  • I tried it but i get the below error : Can't call method "nfreeze" on unblessed reference
    – smith
    Mar 6, 2012 at 10:51
  • Are you import method nfreeze? Do use Storable qw(nfreeze) or write a full specified name of method: Storable::nfreeze($data).
    – Ali
    Mar 6, 2012 at 11:13
  • you are right thanks ,also what is the module which decompress gzip ?
    – smith
    Mar 6, 2012 at 11:38
  • 2
    One notable disadvantage of Storable is that it uses a binary format that is not always backwards/forwards compatible across releases. If your storage is short term it works very well, but if you expect your records to persist for years you should have a migration plan in place for the next time you upgrade Perl or Storable. Or you can use JSON and not have to worry about format changes.
    – Ven'Tatsu
    Mar 6, 2012 at 17:38
  • 1
    One advantage of Storable over JSON is that the former supports referential identity: If you put in $a twice, both references will still refer to the same object after deserialization (though obviously they won't refer to the original object. I think YAML is capable of the same, though you may need a full YAML module to actually use this. Mar 12, 2012 at 10:06
-1

I've never tried it myself, but the perldoc says the return value of Data::Dumper can be "evaled to get back an identical copy of the original reference structure". You could then put the Dumper output into a large enough text field in the database.

1
  • 1
    -1, this would allow a SQL injection attack to escalate to a remote code execution attack. eval STRING should be use very cautiously with any data that is not generated in whole by the program calling eval STRING.
    – Ven'Tatsu
    Mar 6, 2012 at 19:12
-1

What about Data::Dumper? You could dump the objects into a TEXT field of the DB and then eval the content to get it back.

5
  • -1, this would allow a SQL injection attack to escalate to a remote code execution attack. eval STRING should be use very cautiously with any data that is not generated in whole by the program calling eval STRING.
    – Ven'Tatsu
    Mar 6, 2012 at 19:11
  • Although I agree that you should keep this in mind, the OP did not say anything about where his data has been generated from. So I can't see any reason to not take Data::Dumper into account.
    – fenton
    Mar 9, 2012 at 10:16
  • My comment isn't where the data is intended to come from, but where it could come from. The idea of Defense in Depth is to be proactive about security at each layer of an application to prevent a hole in one layer from compromising the next layer. If you ever call eval STRING on any data that returned from your database then you have given your database full access to execute code in your application. Any breach of your database now has full control of your entire application. Don't execute data!
    – Ven'Tatsu
    Mar 9, 2012 at 16:46
  • OK, good point! I assume the libraries mentioned elsewhere in this post do this in a different way?
    – fenton
    Mar 12, 2012 at 9:19
  • Storable is a binary dump of the internal structure of the data. It does have code execution hooks to allow classes to alter how they are stored, but they are limited to executing that classes STORABLE_thaw method if it exists. JSON is a generic data based on the JavaScript object syntax. Most JSON modules use simple parsers that don't include any code execution features.
    – Ven'Tatsu
    Mar 12, 2012 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.