escaping

Single quote handling in a SQL string

十年热恋 提交于 2019-11-29 02:14:48
问题 I have an application where the values in the text field are sent to the database. For example I have a form with one field (text box). When I press Ok button then the content of the text field is inserted as a record into a table. I'm just trimming and extracting the text box's text into variable and passing it to my SQL string. The problem is that whenever something like "It's" or "Friend's" the single quote is identified as the end of string. In Delphi I have seen something like

Can I escape characters in variable names?

走远了吗. 提交于 2019-11-29 02:07:31
Sometimes it would be useful to name variables like no programmer should name his or her variables. Of course there's some good reason for conventions and limitations on stoopid variable names, but still I'd be nice. Particularly in a language like R that is used frequently to create graphs and some labels with the graphs. Thus, some labels contain variable names. Is there a way to use something like a+b as a variable name in R? Or is there something like a display name? For example in faceting with ggplot2 such an option would be great. p_big + facet_grid(x ~ y,scales="free") +labs(x="",y="")

Passing arguments to a command in Bash script with spaces

橙三吉。 提交于 2019-11-29 01:56:48
I'm trying to pass 2 arguments to a command and each argument contains spaces, I've tried escaping the spaces in the args, I've tried wrapping in single quotes, I've tried escaping \" but nothing will work. Here's a simple example. #!/bin/bash -xv ARG="/tmp/a b/1.txt" ARG2="/tmp/a b/2.txt" ARG_BOTH="\"$ARG\" \"$ARG2\"" cat $ARG_BOTH I'm getting the following when it runs: ARG_BOTH="$ARG $ARG2" + ARG_BOTH='/tmp/a\ b/1.txt /tmp/a\ b/2.txt' cat $ARG_BOTH + cat '/tmp/a\' b/1.txt '/tmp/a\' b/2.txt cat: /tmp/a\: No such file or directory cat: b/1.txt: No such file or directory cat: /tmp/a\: No such

What exactly do I have to escape inside a `script` element?

耗尽温柔 提交于 2019-11-29 01:45:31
What parts of JavaScript code do I have to escape inside a script element in a HTML page? Is <>& enough or too much? [EDIT] This is related to this bug: http://code.google.com/p/rendersnake/issues/detail?id=15#c6 comment #6 In HTML (and XHTML if you're an evil person that sends your XHTML pages as text/html ), script tags are #CDATA , and therefore, the only thing that you shouldn't have in the content is </script> , as that is all that the parser looks for to signal the end of the tag. Don't escape anything; just make sure you don't have </script> in the tag content. For example, if you have

Escaping user input from database necessary?

女生的网名这么多〃 提交于 2019-11-29 01:11:38
问题 So I know about MySQL injection and always escape all my user input before putting it in my database. However I was wondering, imagine a user tries to submit a query to inject, and I escape it. What if I then at a later moment take this value from the database, and use it in a query. Do I have to escape it again? So: ( sql::escape() contains my escape function) $userinput = "'); DROP `table` --"; mysql_query("INSERT INTO `table` (`foo`,`bar`) VALUES ('foobar','".sql::escape($userinput)."')");

Is it a bad idea to escape HTML before inserting into a database instead of upon output?

梦想的初衷 提交于 2019-11-29 01:11:34
I've been working on a system which doesn't allow HTML formatting. The method I currently use is to escape HTML entities before they get inserted into the database. I've been told that I should insert the raw text into the database, and escape HTML entities on output. Other similar questions here I've seen look like for cases where HTML can still be used for formatting, so I'm asking for a case where HTML wouldn't be used at all. you will also restrict yourself when performing the escaping before inserting into your db. let's say you decide to not use HTML as output, but JSON, plaintext, etc.

Escaping single quote in String.Format()

会有一股神秘感。 提交于 2019-11-29 01:07:32
I have been all over the 'tubes and I can't figure this one out. Might be simple. The following String.Format call: return dt.ToString("MMM d yy 'at' H:mmm"); Correctly returns this: Sep 23 08 at 12:57 Now let's say I want to add a single quote before the year, to return this: Sep 23 '08 at 12:57 Since the single quote is a reserved escape character, how do I escape the single quote to get it to display? I have tried double, triple, and quad single quotes, with no luck. You can escape it using a backslash which you will have to escape. Either return dt.ToString(@"MMM d \'yy 'at' H:mmm"); or

Escape tags in html

余生颓废 提交于 2019-11-29 01:03:07
What are escape tags in html? Are they " < > to represent " < > ? And how do these work? Is that hex, or what is it? How is it made, and why aren't they just the characters themselves? Maiku Mori How do these work? Anything &#num; is replaced with character from ASCII table, matching that num . Is that hex, or what is it? It's not hex, the number represents characters number in decimal in ASCII table. Check out ASCII table . Check Dec and HTML columns. Why aren't they just the characters themselves? Look at this example: <div>Hey you can use </div> to end div tag!</div> It would mess up the

What's the Use of '\\r' escape sequence?

荒凉一梦 提交于 2019-11-29 00:51:14
I have C code like this: #include<stdio.h> int main() { printf("Hey this is my first hello world \r"); return 0; } I have used the \r escape sequence as an experiment. When I run the code I get the output as: o world Why is that, and what is the use of \r exactly? If I run the same code in an online compiler I get the output as: Hey this is my first hello world Why did the online compiler produce different output, ignoring the \r ? Arnaud Le Blanc \r is a carriage return character; it tells your terminal emulator to move the cursor at the start of the line. The cursor is the position where the

Use jq to parse a JSON String

北战南征 提交于 2019-11-29 00:51:06
I'm trying to get jq to parse a JSON structure like: { "a" : 1, "b" : 2, "c" : "{\"id\":\"9ee ...\",\"parent\":\"abc...\"}\n" } That is, an element in the JSON is a string with escaped json. So, I have something along the lines of $ jq [.c] myFile.json | jq [.id] But that crashes with jq: error: Cannot index string with string This is because the output of .c is a string, not more JSON. How do I get jq to parse this string? My initial solution is to use sed to replace all the escape chars ( \":\" , \",\" and \" ) but that's messy, I assume there's a way built into jq to do this? Thanks! edit: