Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.javascript > #24009
| Path | csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.datemas.de!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail |
|---|---|
| From | Thomas 'PointedEars' Lahn <PointedEars@web.de> |
| Newsgroups | comp.lang.javascript |
| Subject | Re: apostrophes |
| Date | Thu, 01 May 2014 10:42:38 +0200 |
| Organization | PointedEars Software (PES) |
| Lines | 48 |
| Message-ID | <4477360.YgxbPpYeca@PointedEars.de> (permalink) |
| References | <NPadnftYatpNe_zOnZ2dnUVZ_oqdnZ2d@westnet.com.au> <5812622.OnxiGCZgKY@PointedEars.de> |
| Reply-To | Thomas 'PointedEars' Lahn <cljs@PointedEars.de> |
| Mime-Version | 1.0 |
| Content-Type | text/plain; charset="UTF-8" |
| Content-Transfer-Encoding | 8Bit |
| X-Trace | solani.org 1398933759 1096 eJwFwYEBgDAIA7CXhqUo5xQG/59gQoRFvx4M53IXCZ0slnkgd9LRM6fLcHwdxGXpKX0a6f4bPRGt (1 May 2014 08:42:39 GMT) |
| X-Complaints-To | abuse@news.solani.org |
| NNTP-Posting-Date | Thu, 1 May 2014 08:42:39 +0000 (UTC) |
| User-Agent | KNode/4.11.5 |
| X-User-ID | eJwNyMkBwCAIBMCW5NqVchKE/kvQ50wYBEVHwGNixlp18av/pOyM8sdqb4WIw7nUG8p3aWW7Y59DCpmzUHoBOG8Ueg== |
| Face | iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAGFBMVEXTxa4RFk5dUWANED8PFEfy7+MGBiW+n3ZNF/QuAAACaElEQVQ4jVXUwVOcMBQG8Dc7Rc4PUntdWV2uxjDpGaGeozOp1woar4jd5t/v9wLstMwsA/ntlxdCAgUc1hjTc9/JCZfGoo3wG3HdmdAWrIJRHe7GM/TmpY5VFefuVcAkkPbLIaN8rmPmjloyZxgyR3GuJ4K0AGtJ2htz8o7yqikm759fldQXaMpbDzjKAG+8v+AugVTOPO5DOjLvGtUYQwh0CPjnVMyGd+8/GfUB5nLKJDD2aLDh5HYyMDJGDwQIo2ZmZcKbowNmAdB/AzyFhrmF2MHRb0QJJfaAnwGB6orZhoykLzJtGwF/xpYxI1dswomiUj3gTuAIqCn/4C7cULwGNBtwMTk3Y4LfKB5YUaOKBKYtpplm7u0vip8tU1NWWyI/7XdcSuIDoMt6rVHMWT0DbjHPGqDqZVSa6zleLcUTcIKLoMv3ueJluALtAo9B302zPPlrtiVScRdCjXvVh3e3JpYa/jjkuC9N+LrBMlz/eAN4eQijX2EdLo6c5tGGHwLyHFtXk89dDGHwCVhG9T0S/j55AhRZgkMCmUQXJ49TnS1wnQDvw0eAh9ICeMmEFbCnPMFzjAvsWoEWEFdYEx+S0MoUZ1gT1wId8+AF3Bl2OoEu906AUHx5VLw/gXYg/x84loOah/2UYNrgiwSwGO7RfUzVBbx/kgpckumGOi6QirtD6gkLTitbnxNol47S2jVc2vsN5kPqaAHT8uUdAJM4v/DanjYOwmUjWznGfwB7sGtAtor5BgofDuzaRj4kSQAqDakTsKORa3Q3xKi3gE1fhl71KRMqrdZ2AWNNg/YOhQyrVBnb+i+nEg4bsDA+egAAAABJRU5ErkJggg== |
| X-Face | %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&.<b';Md8`dH6iqhT)6C^.Px|[=M@7=Ik[_w<%n1Up"LPQNu2m8|L!/3iby{-]A+#YE}Kl{Cw$\U!kD%K}\2jz"QQP6Uqr],./"?;=4v |
| Cancel-Lock | sha1:UFFHp0YQPM4uxmHfuC06T9PSH4w= |
| X-NNTP-Posting-Host | eJwFwQkBwDAIA0BL5QkUOZAO/xJ2BwsJpgfCsdhUqQGuscZH/ex+eYXd4NHpmZJHV6M9pvUPGmsRfA== |
| Xref | csiph.com comp.lang.javascript:24009 |
Show key headers only | View raw
Thomas 'PointedEars' Lahn wrote:
> Andrew Poulos wrote:
>> I have a form into which users enter their names. The names get saved to
>> a db. (Any apostrophes get encoded before being written to the db.)
>> […]
>> One way I've considered is backslashing a double quote eg
>>
>> Response.write("var name = \"" + recSet("name").value + "\";");
>>
>> which will only work until someone enters a name like
>> Stan "The Man" Longinidis
>>
>> What's a better way of handling single/double apostrophes?
>
> Sanitize input, escape output.
>
> Assuming that the string value does not contain newline:
>
> Response.write(
> "var name = '"
> + recSet("name").value.replace(/[\\']/g, "\\\\$&")
> + "';");
Nonsense. I meant
Response.write(
"var name = '"
+ recSet("name").value.replace(/[\\']/g, "\\$&")
+ "';");
so as to escape backslashes and apostrophes with *one* backslash each.
I would also not assume that it is not possible to enter newline. For
example, if the input would be expected from an “input” element, an attacker
could turn it into a “textarea” element or simply prepare their own request.
You need to consider such attack vectors both for sanitizing the database
input and for escaping the output.
For database input, and preventing SQL injection, it would be best if you
could use prepared statements. For escaping output, and preventing XSS,
(the equivalent of) JSON.stringify() would be best.
--
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not Cc: me. / Bitte keine Kopien per E-Mail.
Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
apostrophes Andrew Poulos <ap_prog@hotmail.com> - 2014-05-01 16:15 +1000
Re: apostrophes JJ <duh@nah.meh> - 2014-05-01 15:15 +0700
Re: apostrophes Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-05-01 10:28 +0200
Re: apostrophes Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-05-01 10:42 +0200
Re: apostrophes "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2014-05-01 13:34 +0200
Re: apostrophes Richard Damon <Richard@Damon-Family.org> - 2014-05-03 10:00 -0400
Re: apostrophes "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2014-05-03 17:00 +0200
Re: apostrophes Richard Damon <Richard@Damon-Family.org> - 2014-05-03 12:54 -0400
csiph-web