Is MySQL more resistant to SQL injection attack than PostgreSQL (under Perl/DBI) ?
I am reviewing a Linux based perl web application that contains a login handler with the ubiquitous

my $sth = $DB->prepare("SELECT password from passwords where userid='$userid'") or die; $sth->execute or die; ...

where $userid is initialized from (unsafe, unfiltered) web user input.

The DBI documentation recommends that this code should be changed to use the placeholder "?" in place of '$userid' for security, which would be a good idea but for now we leave it as-is. 

Anyway the application can be configured to use PostgreSQL and MySQL and someone had asked about this vulnerability so I tried out both databases and tested each configuration with some SQL injection attempts. 

Under PostgreSQL an input of '; do bad stuff here; and here;  would crash the login cgi as expected and execute the bad stuff. 

What was unexpected was that MySQL resisted this attack.  This got me to wonder if there was a setting of some sort for DBD::MySQL or elsewhere that limited prepare to 1 statement per call, or was MySQL resistant in some other way. 

As I understand it MySQL is not SQL-injection resistant in general. 

This is not a question purely about techniques for eliminating SQL injection; for that perhaps see http://stackoverflow.com/questions/2200256/how-can-i-avoid-sql-injection-attacks.  

The question is: Is MySQL somehow more resistant than PostgreSQL to SQL injection attack under the PERL DBI and why might this be the case?
Is MySQL more resistant to SQL injection attack than PostgreSQL (under Perl/DBI) ?
===

I am reviewing a Linux based perl web application that contains a login handler with the ubiquitous

my $sth = $DB->prepare("SELECT password from passwords where userid='$userid'") or die; $sth->execute or die; ...

where $userid is initialized from (unsafe, unfiltered) web user input.

The DBI documentation recommends that this code should be changed to use the placeholder "?" in place of '$userid' for security, which would be a good idea but for now we leave it as-is. 

Anyway the application can be configured to use PostgreSQL and MySQL and someone had asked about this vulnerability so I tried out both databases and tested each configuration with some SQL injection attempts. 

Under PostgreSQL an input of '; do bad stuff here; and here;  would crash the login cgi as expected and execute the bad stuff. 

What was unexpected was that MySQL resisted this attack.  This got me to wonder if there was a setting of some sort for DBD::MySQL or elsewhere that limited prepare to 1 statement per call, or was MySQL resistant in some other way. 

As I understand it MySQL is not SQL-injection resistant in general. 

This is not a question purely about techniques for eliminating SQL injection; for that perhaps see http://stackoverflow.com/questions/2200256/how-can-i-avoid-sql-injection-attacks.  

The question is: Is MySQL somehow more resistant than PostgreSQL to SQL injection attack under the PERL DBI and why might this be the case?