title: Reading SQL from local files, then eval-ing it. Safe?
body: <p>I've inherited code that has very large SQL queries within code, typically within heredocs and with variables interpolated that will dynamically select a table or fields, like this:</p>
  
  <pre><code>    my $query = &lt;&lt;"SQL";
  SELECT foo
  FROM $some_table
  WHERE bar = 'baz'
  SQL
  </code></pre>
  
  <p>Some of the SQL queries are quite large. The issue is that this makes my Perl files unnecessarily long and difficult to read. Code analysis and highlighting tools can't parse the heredoc SQL, either.</p>
  
  <p>I'd like to keep SQL in actual SQL files and change Perl code like the above to read a file from the local directory:</p>
  
  <pre><code>my $query = eval(get_sql('some-file.sql'));
  </code></pre>
  
  <p>... <code>eval</code>-ing it so that all in-scope vars are expanded.</p>
  
  <p>Some of this would take place in web accessible scripts where users are passing parameters. Absolutely all variables are cleaned, and I use paramaterized statements in all criteria clauses (WHERE, AND, etc.)</p>
  
  <p>There's a lot of FUD about using <code>eval()</code>, so I'd like to know: Is my solution safe to use in a web application?</p>
  
  <p><em>EDIT</em>...<br>
  I should mention further that the <code>get_sql()</code> function might look something like this:</p>
  
  <pre><code>sub get_sql {
      my ($filename) = @_;
  
      my $sql = slurp("/path/to/file/$filename.sql");
      my $query = qq|return qq{| . $sql . qq|};|;
      return $query;
  }
  </code></pre>
  
  <p>I understand that the quote operators can't appear in the SQL string that will be returned.</p>
  
  <p><em>EDIT2</em>...<br>
  This is an eminently reasonable question given any number of use cases and/or constraints. Downvotes... not warranted, folks.</p>