473,405 Members | 2,404 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,405 software developers and data experts.

Escaping quotes and injections

229 100+
Hi, I wonder if someone could advise on the following.
I inherited this code, I am not a coder but have had some kind of hack and am looking at code to reduce its vulnerability. At the top of the page I have

Expand|Select|Wrap|Line Numbers
  1.     nPage = CLng(Request.QueryString("Page"))
  2.  
  3.  
  4.     Keyword = Trim(Request.QueryString("Keyword"))
  5.  
in the where clause I have
Expand|Select|Wrap|Line Numbers
  1. p.area LIKE '%" & Replace(Keyword, "_", " ") & "%'
I need to replace these for the query string, but do I also need to add an escape

Expand|Select|Wrap|Line Numbers
  1. p.area LIKE '%" & Replace(Keyword, "'", "''") & "%'



Thanks for any advice.
Richard
Apr 28 '15 #1
1 1322
Rabbit
12,516 Expert Mod 8TB
What do you mean by escape? Replacing single quotes with double single quotes is an escape for quotes. But if you want to truly protect against injection, you should use parameters instead.
Apr 28 '15 #2

Sign in to post your reply or Sign up for a free account.

Similar topics

1
by: mudassar | last post by:
Hello I've been trying to figure this problem out for quite a while and I'm having no joy. I'll give you some background info, I'm creating a form and one of the fields in the form is a big ...
13
by: lawrence | last post by:
A user writes this sentence: "It was the New Urbanist's nightmare of sprawl run amok." They input that and my PHP script hits it with addslashes() and then the sentence gets put in the database....
1
by: Ted Weatherly | last post by:
Hello, I want to dynamically create a table cell with a textfield in it. The value for the textfield can have quotes. e.g. I have this snippet of javascript code: var td =...
7
by: duwayne | last post by:
I have a problem of escaping quotes in javascript. Ex: onclick='alert( "Mister O'Hara" )' onclick='alert( "Mister O\'Hara" )' both gives me an error. How would I escape this?
5
by: andy.z | last post by:
I'm writing a PHP line to the foot of a file using another language. my problem is I'm not sure how to write it so that the quotes (both single and double) are corret for PHP to process. The...
2
by: zottty | last post by:
Dear Friends, I just can't find the solution for escaping strings for MSSQL. I guess it is a usual problem. I want to escape a string in a C# application, what should I change? string...
3
by: nitinpatel1117 | last post by:
Hi, I've got a PHP and MySQL related problem, and it may sound like an amatuer's question. but any help on this will be greatly appreciated Basically, I have a php variable that i want to store...
1
by: alanv | last post by:
Hello, I'm having a problem with double quotes, @ symbols and # signs. When a user submits a text field with those symboles for example, its cuts them off like so... INSERT INTO po_item SET...
1
by: Mike P | last post by:
Can anybody tell me what is wrong with this code? I am thinking it is something to do with how I am escaping the quotes. <img src="pix2.asp?lbmid=" & Request.QueryString("LBMID") & "&LBMEmail="...
0
by: emmanuelkatto | last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud. Please let me know. Thanks! Emmanuel
1
by: nemocccc | last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
0
by: Hystou | last post by:
There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
0
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
0
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...
0
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...
0
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...
0
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each...
0
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.