Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #24009

Re: apostrophes

Show all headers | View raw

Thomas 'PointedEars' Lahn wrote:

> Andrew Poulos wrote:
>> I have a form into which users enter their names. The names get saved to
>> a db. (Any apostrophes get encoded before being written to the db.)
>> […]
>> One way I've considered is backslashing a double quote eg
>> 
>> Response.write("var name = \"" + recSet("name").value + "\";");
>> 
>> which will only work until someone enters a name like
>> Stan "The Man" Longinidis
>> 
>> What's a better way of handling single/double apostrophes?
> 
> Sanitize input, escape output.
> 
> Assuming that the string value does not contain newline:
> 
>   Response.write(
>       "var name = '"
>     + recSet("name").value.replace(/[\\']/g, "\\\\$&")
>     + "';");

Nonsense.  I meant

  Response.write(
      "var name = '"
    + recSet("name").value.replace(/[\\']/g, "\\$&")
    + "';");

so as to escape backslashes and apostrophes with *one* backslash each.

I would also not assume that it is not possible to enter newline.  For 
example, if the input would be expected from an “input” element, an attacker 
could turn it into a “textarea” element or simply prepare their own request.
You need to consider such attack vectors both for sanitizing the database 
input and for escaping the output.

For database input, and preventing SQL injection, it would be best if you 
could use prepared statements.  For escaping output, and preventing XSS, 
(the equivalent of) JSON.stringify() would be best.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not Cc: me. / Bitte keine Kopien per E-Mail.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

apostrophes Andrew Poulos <ap_prog@hotmail.com> - 2014-05-01 16:15 +1000
  Re: apostrophes JJ <duh@nah.meh> - 2014-05-01 15:15 +0700
  Re: apostrophes Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-05-01 10:28 +0200
    Re: apostrophes Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-05-01 10:42 +0200
  Re: apostrophes "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2014-05-01 13:34 +0200
    Re: apostrophes Richard Damon <Richard@Damon-Family.org> - 2014-05-03 10:00 -0400
      Re: apostrophes "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2014-05-03 17:00 +0200
        Re: apostrophes Richard Damon <Richard@Damon-Family.org> - 2014-05-03 12:54 -0400

csiph-web