Beefy Boxes and Bandwidth Generously Provided by pair Networks
Don't ask to ask, just ask

Re: Securing HTML query strings

by olus (Curate)
on Aug 16, 2008 at 22:49 UTC ( #704753=note: print w/ replies, xml ) Need Help??

in reply to Securing HTML query strings

If I understand correctly, your concern is with validating info before going to the database, even though there might be some other validations (business rules?) that you are considering. If that is the case, as with the ' character, you could consider using placeholders in your queries.

Comment on Re: Securing HTML query strings
Replies are listed 'Best First'.
Re^2: Securing HTML query strings
by rooneyl (Sexton) on Aug 17, 2008 at 19:34 UTC
    My main concern is with dealing with the ' character, as it can be used for SQL injection attacks. Lawliet suggested using HTML:entities which converts the ' character into its HTML value. Could placeholders be used to stop ' being processed literally as well?

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://704753]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others about the Monastery: (4)
As of 2016-02-14 02:39 GMT
Find Nodes?
    Voting Booth?

    How many photographs, souvenirs, artworks, trophies or other decorative objects are displayed in your home?

    Results (455 votes), past polls