Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #24016

Re: apostrophes

Show all headers | View raw

On 5/1/14, 7:34 AM, Evertjan. wrote:
> Andrew Poulos <ap_prog@hotmail.com> wrote on 01 mei 2014 in
> comp.lang.javascript:
>
> > What's a better way of handling single/double apostrophes?
>
> Never heard of a "double apostrophe" btw. ;-)
>
> I replace the [single] apostrophe ' with a single back quote ` before
> storing
> them into a database, and replace it back on printing.
>
> On a debugging level, these string fields look acceptable.
>
> This way searching the database is far easier than having multiple
> characters, also because wildcard searches are more inuitive.
>
> You wouldn't want to store strings with apotrophes in a sql/access-type
> database anyway because of the danger of SQL Injection Attacks.
>
> [SQL Injection Attacks could be prevented by using a parametric method,
> but I usually don't bother with that.]
>

The way to stop Injection Attacks is to routinely sanitize data sent to
the database by escaping the characters with the function provided by
the database layer for that purpose (like mysql_real_escape_string), or
to use prepared statements. You method is incomplete (unless you didn't
describe it fully) as, for example, if a name is entered with a trailing
\, and you are just building up a string for your query, that \ will
"escape" the ending quote in your statement and your statement will fail
due to a syntax error.

Note that the database won't have the escape sequences stored in them
(\') but only the character that was escaped ('), thus you actually have
LESS code, as their is no need to do any conversion on reading from the
database, it will always give you back what you intended to write.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

apostrophes Andrew Poulos <ap_prog@hotmail.com> - 2014-05-01 16:15 +1000
  Re: apostrophes JJ <duh@nah.meh> - 2014-05-01 15:15 +0700
  Re: apostrophes Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-05-01 10:28 +0200
    Re: apostrophes Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-05-01 10:42 +0200
  Re: apostrophes "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2014-05-01 13:34 +0200
    Re: apostrophes Richard Damon <Richard@Damon-Family.org> - 2014-05-03 10:00 -0400
      Re: apostrophes "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2014-05-03 17:00 +0200
        Re: apostrophes Richard Damon <Richard@Damon-Family.org> - 2014-05-03 12:54 -0400

csiph-web