apostrophe in text

[lespaul]

So we have a web page that has a text box where the user can enter something like:
[tt]
Short Description: [highlight white]Judge's Orders[/highlight]
[/tt]

however when that gets input into the update query string:

[tt]strSQL = "Update TableName Set ShortDesc = '" + shortDesc + "'"[/tt]

it doesn't work. We've tried replacing it with an escape character, but that doesn't do what we need either. What we need is to be able to capture and enter apostrophe's in the database.

I'm sure someone has solved this, I just can't find the solution....any assistance?

Thanks!

Leslie

Have you met Hardy Heron?

 

[Ascalonian]

Need to use two apostrphes...

shortDesc = document.getElementById("textBoxId").value;
shortDesc = theShortDesc.replace(/'/g,\'\');

My regex is rusty if you couldn't tell, but that should give you a jump start... I hope.

 

[Ascalonian]

Okay... I am a moron. For some reason I thought I was in the JavaScript forum.

But you can use the <str:replace> tag to do the same thing I believe.

 

[lespaul]

ok I'll pass that along to the developer who's working on it Monday and we'll give it a shot!
I'll let you know.

Leslie

 

[prosper]

There is another way to solve and it needs more modification but it is more secure.
If you use preparedstatement, Java will escape(handle) all the control character like apostrophe, question mark...automatically.

private myUpdate(Connection con, String description, String idFound){
try{
    ResultSet rs = null;
    String sql = "Update TableName Set ShortDesc = ? where         id=?";
    PreparedStatement ps = con.prepareStatement(sql);
    ps.setString(1,description);
    ps.setString(2,idFound);
    PreparedStatement ps = con.prepareStatement();
    rs = ps.executeUpdate();
}
catch (Exception e){
      e.printStackTrace();
      }
}

 

[prosper]

private void myUpdate(Connection con, String description, String idFound){
try{
    ResultSet rs = null;
    String sql = "Update TableName Set ShortDesc = ? where         id=?";
    PreparedStatement ps = con.prepareStatement(sql);
    ps.setString(1,description);
    ps.setString(2,idFound);
    PreparedStatement ps = con.prepareStatement();
    rs = ps.executeUpdate();
}
catch (Exception e){
      e.printStackTrace();
      }
}

 

[jaxtell]

Prosper has the right solution in my opinion. As an additional measure, I'd suggest creating a (or using an already existing) method to escape special characters. This can be beneficial for saving to the database (preventing SQL injection), as well as helping to prevent creation of malicious code (Cross site scripting).

-----------------------------------------
I cannot be bought. Find leasing information at

http://www.joshaxtell.com/