Beefy Boxes and Bandwidth Generously Provided by pair Networks
good chemistry is complicated,
and a little bit messy -LW

Re: Securing HTML query strings

by olus (Curate)
on Aug 16, 2008 at 22:49 UTC ( #704753=note: print w/replies, xml ) Need Help??

in reply to Securing HTML query strings

If I understand correctly, your concern is with validating info before going to the database, even though there might be some other validations (business rules?) that you are considering. If that is the case, as with the ' character, you could consider using placeholders in your queries.

Replies are listed 'Best First'.
Re^2: Securing HTML query strings
by rooneyl (Sexton) on Aug 17, 2008 at 19:34 UTC
    My main concern is with dealing with the ' character, as it can be used for SQL injection attacks. Lawliet suggested using HTML:entities which converts the ' character into its HTML value. Could placeholders be used to stop ' being processed literally as well?

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://704753]
and all is quiet...

How do I use this? | Other CB clients
Other Users?
Others avoiding work at the Monastery: (9)
As of 2018-06-22 20:59 GMT
Find Nodes?
    Voting Booth?
    Should cpanminus be part of the standard Perl release?

    Results (124 votes). Check out past polls.