Geek Answers Handbook

Misinform data for SQL using JavaScript

I have a bunch of forms that have various input elements. I want to process them on the server side (yes, I use server-side JavaScript) to use these inputs as parameters and to prevent invalid characters.

Before you go, for example, “this is not JavaScript”, etc. etc.

I am using a multi-million dollar licensed software solution that has JavaScript, but apparently does not have standard features like this. So, whatever I use, I can assure you that you probably never touched it or heard of it. And it supports server side javascript, because well, the language is cool.

My first task is to misinform the data before it enters the database, and I just like, for example, how Ruby marks external data: tainted. And I do not have any corrupted data. That way I could google and copy some bad regex from here and there, and I had some kind of sad example. However, I would like to have a function that says "well, that removes 70% of the possible material from this data and is pretty good sanitized."

Basically, a string of these elements should be escaped, and I assume that for this my desire, better methods already exist.

function sanitize(myString) { ... ; return myString }

How can I avoid characters like "# !? and other special characters, and how can I get them back? I know the JavaScript escape code method, but I want to know if the function was already debugged and available to the public before I reinvent the wheel.

I thought: - JavaScript Escape - Base64 Encoding - Regex

I am just asking people who previously wrote such functions.

Thank,

+5
source share
1 answer

See update below.

. , , , - " ". Java PreparedStatement, . , SQL- . , , :

preparedStatement = prepare("insert into mytable (id, name) values (?, ?)")
preparedStatement.setField(0, theId);
preparedStatement.setField(1, theName);

:

statement = "insert into mytable (id, name) values ('" + theId + "', '" + theName + "')"

..., .

" " , . , , . . .

: , ? , , , : " ...". : . , , , , . .

. , Rhino . ! PreparedStatement JDBC . ( -Java lurkers: Rhino - JavaScript Java VM. .)

+9

More articles:


All Articles