Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.datemas.de!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups: comp.lang.javascript
Subject: Re: apostrophes
Date: Thu, 01 May 2014 10:42:38 +0200
Organization: PointedEars Software (PES)
Lines: 48
Message-ID: <4477360.YgxbPpYeca@PointedEars.de>
References: <NPadnftYatpNe_zOnZ2dnUVZ_oqdnZ2d@westnet.com.au> <5812622.OnxiGCZgKY@PointedEars.de>
Reply-To: Thomas 'PointedEars' Lahn <cljs@PointedEars.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8Bit
X-Trace: solani.org 1398933759 1096 eJwFwYEBgDAIA7CXhqUo5xQG/59gQoRFvx4M53IXCZ0slnkgd9LRM6fLcHwdxGXpKX0a6f4bPRGt (1 May 2014 08:42:39 GMT)
X-Complaints-To: abuse@news.solani.org
NNTP-Posting-Date: Thu, 1 May 2014 08:42:39 +0000 (UTC)
User-Agent: KNode/4.11.5
X-User-ID: eJwNyMkBwCAIBMCW5NqVchKE/kvQ50wYBEVHwGNixlp18av/pOyM8sdqb4WIw7nUG8p3aWW7Y59DCpmzUHoBOG8Ueg==
Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAGFBMVEXTxa4RFk5dUWANED8PFEfy7+MGBiW+n3ZNF/QuAAACaElEQVQ4jVXUwVOcMBQG8Dc7Rc4PUntdWV2uxjDpGaGeozOp1woar4jd5t/v9wLstMwsA/ntlxdCAgUc1hjTc9/JCZfGoo3wG3HdmdAWrIJRHe7GM/TmpY5VFefuVcAkkPbLIaN8rmPmjloyZxgyR3GuJ4K0AGtJ2htz8o7yqikm759fldQXaMpbDzjKAG+8v+AugVTOPO5DOjLvGtUYQwh0CPjnVMyGd+8/GfUB5nLKJDD2aLDh5HYyMDJGDwQIo2ZmZcKbowNmAdB/AzyFhrmF2MHRb0QJJfaAnwGB6orZhoykLzJtGwF/xpYxI1dswomiUj3gTuAIqCn/4C7cULwGNBtwMTk3Y4LfKB5YUaOKBKYtpplm7u0vip8tU1NWWyI/7XdcSuIDoMt6rVHMWT0DbjHPGqDqZVSa6zleLcUTcIKLoMv3ueJluALtAo9B302zPPlrtiVScRdCjXvVh3e3JpYa/jjkuC9N+LrBMlz/eAN4eQijX2EdLo6c5tGGHwLyHFtXk89dDGHwCVhG9T0S/j55AhRZgkMCmUQXJ49TnS1wnQDvw0eAh9ICeMmEFbCnPMFzjAvsWoEWEFdYEx+S0MoUZ1gT1wId8+AF3Bl2OoEu906AUHx5VLw/gXYg/x84loOah/2UYNrgiwSwGO7RfUzVBbx/kgpckumGOi6QirtD6gkLTitbnxNol47S2jVc2vsN5kPqaAHT8uUdAJM4v/DanjYOwmUjWznGfwB7sGtAtor5BgofDuzaRj4kSQAqDakTsKORa3Q3xKi3gE1fhl71KRMqrdZ2AWNNg/YOhQyrVBnb+i+nEg4bsDA+egAAAABJRU5ErkJggg==
X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&.<b';Md8`dH6iqhT)6C^.Px|[=M@7=Ik[_w<%n1Up"LPQNu2m8|L!/3iby{-]A+#YE}Kl{Cw$\U!kD%K}\2jz"QQP6Uqr],./"?;=4v
Cancel-Lock: sha1:UFFHp0YQPM4uxmHfuC06T9PSH4w=
X-NNTP-Posting-Host: eJwFwQkBwDAIA0BL5QkUOZAO/xJ2BwsJpgfCsdhUqQGuscZH/ex+eYXd4NHpmZJHV6M9pvUPGmsRfA==
Xref: csiph.com comp.lang.javascript:24009

Thomas 'PointedEars' Lahn wrote:

> Andrew Poulos wrote:
>> I have a form into which users enter their names. The names get saved to
>> a db. (Any apostrophes get encoded before being written to the db.)
>> […]
>> One way I've considered is backslashing a double quote eg
>> 
>> Response.write("var name = \"" + recSet("name").value + "\";");
>> 
>> which will only work until someone enters a name like
>> Stan "The Man" Longinidis
>> 
>> What's a better way of handling single/double apostrophes?
> 
> Sanitize input, escape output.
> 
> Assuming that the string value does not contain newline:
> 
>   Response.write(
>       "var name = '"
>     + recSet("name").value.replace(/[\\']/g, "\\\\$&")
>     + "';");

Nonsense.  I meant

  Response.write(
      "var name = '"
    + recSet("name").value.replace(/[\\']/g, "\\$&")
    + "';");

so as to escape backslashes and apostrophes with *one* backslash each.

I would also not assume that it is not possible to enter newline.  For 
example, if the input would be expected from an “input” element, an attacker 
could turn it into a “textarea” element or simply prepare their own request.
You need to consider such attack vectors both for sanitizing the database 
input and for escaping the output.

For database input, and preventing SQL injection, it would be best if you 
could use prepared statements.  For escaping output, and preventing XSS, 
(the equivalent of) JSON.stringify() would be best.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not Cc: me. / Bitte keine Kopien per E-Mail.