ok, I know that the reason I am getting an error in my insert statement is because of a apostrophe ('). What I am trying to do,or at least figure out is, what can I do to cover come the (') issue? I'm writing the app in asp and basically a customer who is cancelling an order has to provide reasons as to why they are cancelling the order... they are provided a comment box and then submited to another page and requested using the basic request.form("commentbox"). The statement that runs on the second page is\n"INSERT into webordercancel values ('"&session("uid")&"','"&commentbox&"');" Obviously you can see where the error would come into play. The (') from the submited comment cancels out the one that is actually inside the code.... any clues?
212050
You need to replace any quotes (" or ') with a second quote.\n\nSo if your comment is:\n\nI really liked when he said, "Go forth, wise one."\n\nYou would change it to:\n\nI really liked when he said, ""Go forth, wise one.""\n\nThat will allow the insert to propertly insert the state into the database.  Please note that it will not have two quotes in the database.\n\nSo if you did:\n\nSELECT Comment FROM MyTable\n\nYou would see:\n\nI really liked when he said, "Go forth, wise one."
260061
&#92;r&#92;n stands for Return and Newline (Displays the following in next line). But it is not Part of HTML. It is a part of scripting language such as ASP or PHP
564891
I hate the darn things. I have one in my name and it's a real pain.\n\nApplications written in SQL have a real problem with them too and usually error out if you include one.\n\n\nOther than that it's just plain lazy.
531593
You have a character that is unreadable like © ® in the document? Make sure your quotations are correct and all code is perfect...touchy touchy with proper code.\n\nEmail me your site url\n\n\nMike\n\n=================
143705
I had this same problem about a month ago.  The solution that\nworked for me was to place a semicolon on the end of the return statement for the onSubmit parameter.  \n\nExample: <form onsubmit="return emailcheck(this);" action="mailto:myemailishere@e... submission" method="post" enctype="text/plain">\n\nnotice the semicolon after the end of the closing parenthesis on "this" \n\nI hope this helps.
37822
Assuming you do this on the server side, look for the user name and password in the request collection in you particular language - the variable name will be the names you give them in the input text items on the form.\n\nIf you are talking client side, have the form call a javascript function on the onclick event, the use a location.replace or location.href method to ship them off.
401875
If you are in VBA in MS Access? Than you can cut the string and used the variable directly and then finish the string.\n\nstudTbl.Open "SELECT * FROM [studlst] where ([no]=" & i &")"
307296
Put this in an asp page and try it.I jus did it and it worked. \n\n<%@ Language=VBScript %>\n<HTML>\n<HEAD>\n<META NAME="GENERATOR" Content="Microsoft Visual Studio 6.0">\n</HEAD>\n<BODY>\n<form name="frmTest" method="post">\n<img src="Bluebar.gif" ></img>\n<br>\n<LABEL id="lblclick" onclick="ShowList()">Click on this</LABEL>\n<P> </P>\n<br>\n<LABEL id="lblShow" ></LABEL>\n</form>\n</BODY>\n</HTML>\n<script language="javascript">\nfunction ShowList()\n  {\n   window.document.getElementById('lblShow').innerHTML = "Hey ! you just viewed and clicked me :)"\n  }\n</script>\n\nDude.....the window.document.getElementById will show as .... I tried all methods and yahoo still sucks...\nSo here I will explain.  getElementBytId() .In this bracket you need to give the Label which is displaying the text, its id , i.e in this case getElementBytId('lblShow'), and after the close parenthesis we give ".innerHTML" and then "=" what value we want to give.\nhave issues still then, send me a mail at nigeljd@gmail.com
125184
The two bars afterwards are ascii characters that reprsent cariage returns or it tells them when the enter key was pressed.  Such as:\n\nThis here | would be\n\nThis here\nwould be\n\nSo you would have to input the test file into a string and then parse out the | with a valid carriage return character before applying it to the text box.  Hope this helps.
627370
I would never use a column name with a parenthesis in it, so I think you should change that first.\n\nJust call the column name instead....like select 1 from table etc...if its in column 1.
343900
Try to place your code inside a textarea field on a form. \n\neg\n\n<form>\n<textarea>your code</textarea>\n</form>
546633
Yes.  Filtering the single quote will fend off a quoted attack, but not a direct attack.  Consider a query string dynamically assembled that looks like \n\n"SELECT CompanyName FROM Shippers Where OrderNum = " &  myVar &  ";"\n\nFirst problem -- what if you haven't trapped against wild cards?\n\nSecond problem -- what if the input field from your web form is not validated (and I don't mean client-side validation -- hacker will just create their own html forms page to hack your site, sans validation!)\n\nOn your form, if I enter the following into the following field bound to myVar: "* UNION ALL SELECT CompanyName FROM Customers WHERE 1=1" you are in trouble (note that the quotes here are for your benefit -- I wouldn't type double or single quotes into the input field.\n\nSELECT CompanyName FROM Shippers WHERE OrderNum = * UNION ALL SELECT CompanyName FROM Customers WHERE 1=1.\n\nHere's a great paper on this subject: http://www.spidynamics.com/papers/SQLInjectionWhitePaper.pdf#search='sql%20injection'
355091
It sounds like there's a problem in your code, or in the database. It's hard to tell from the amount of detail given, but I'd say that the customer ID procedure isn't the issue...\n\nRawlyn.
355610
$sql= "INSERT INTO members ("username, first_name, last_name, password, email") VALUES ("”.$uname.”,”.$password.”,”.$...\n\nYou're not escaping the quotes. Your string is this "INSERT INTO members (" and the rest is trash, because that quote is closing the string for the PHP parser. You should use single quotes or escape the double quotes.\n\nAnyway, the quotes there are at least not necessary. You should try:\n\n$sql= "INSERT INTO members (username, first_name, last_name, password, email) VALUES (”.$uname.”,”.$password.”,”.$...
103550
I only have limited experience with PHP, however, the first comma in that line:\nssh2_auth_password(, $sftp_user_name,\nMay not be needed?  Along with the space.
160380
I'd like to see more of your code in order to diagnose the error, but I'd presume that the error is not in your regular expressions, but somewhere else in the XSLT file.\n\nExamine the syntax of your file carefully. Or post it to this question, and I'll have a look at it.
656391
I find that irritating as well.  I would suggest one of two things:\n\n1) \nHighlight cells in question\nGo to FORMAT pull down menu and select CELLS\nSelect the NUMBERS tab\nIn the CATEGORY window, select NUMBER and indicate how many decimal places to the right (or select whichever number category you deem appropriate)\nClick OK\n\n2) Worse Case Scenario\nType a single apostrophe in front of the number in each cell\nDon't worry, the apostrophe will not be visible after you hit the Enter/Return key\n\nGood luck!