basically i got a text editor that will send possibly HTML tags to my table.  I'm using this text editor in my website   But what if someone uses the ' character?  I have been searching for a way to allow users to enter VARCHAR type characters in my website. In mysql there is the escape string function. What is its alternative in sqlserver. I have been searching a lot...  havent found what I am searching for so far.  Please help me out.  Thanks ^_^
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
50605
How do I save user-entered line breaks from a &lt;textarea&gt; HTML element to a database?  It always removes the line breaks.
64797
Situation: It started out as me  for the literal string C-c in  but it ended up omitting the - sign and showing results which contained the strings C/C++ and C &amp; C++.  is an example of a post which contains that string of characters (yet fails to show up in the results).  Things I've tried:   post suggests that I can use the undocumented code: operator, but when I do that, it just wraps the whole term in double quotes like .  As @terdon in Unix &amp; Linux chat has , using this  does yield some relevant results, but it doesn't show me  that is supposed to be there. edit: It appears that the Symbolhound query no longer returns that result.  Finally,  says that you can search for literal characters, but as you can see:    Quoted phrases are exact matches except for case-sensitivity, for example, you can search  or .  The second example (symbols) leads to 0 results.  So by now I assume that the search engine has changed (but the old documentation still lingers on this site). Is there a method for me to search for strings that include special (or is it literal?) characters?
60098
I want to format an SQL table the right way in a Stack&nbsp;Overflow question.  ID Name  1 Tom  I know the example above is not the right way. I even tried an HTML table approach, but it's still wrong. Please help, because I need to include SQL tables later...
11438
Suppose I press the A key in a text editor and this inserts the character a in the document and displays it on the screen. I know the editor application isn't directly communicating with the hardware (there's a kernel and stuff in between), so what is going on inside my computer?
121199
When I run a particular SQL script in Unix environments, I'm am seeing a '^M' character at the end of each line of the SQL script as it is echoed to the command-line.  I don't know on which OS the SQL script was originally created.  What is causing this and how do I fix it?
24518
Is it just that nvarchar supports multibyte characters? If that is the case, is there really any point, other than storage concerns, to using varchars?
39060
Whenever I try to insert " or ' I have to validate it by space, otherwise strange things happen as with ' followed by an a becomes áinstead of just 'a, similar behaviour with double quotes. I find this annoying and want to disable it. How do I do that?
22775
Is there a library or acceptable method for sanitizing the input to an html page?  In this case I have a form with just a name, phone number, and email address.    Code must be C#.  For example:  "&lt;script src='bobs.js'&gt;John Doe&lt;/script&gt;" should become "John Doe"
77035
I've been playing around with emacs lisp, and I wanted to write a little function to do a regular expression search and replace.  I had a heck of a time getting the regular expression to work correctly because I didn't realize that all the special characters need to be double escaped when writing lisp code (but not when using query-replace-regexp interactively!).    So for example, using query-replace-regexp interactively you can use   ^\(.*\)[\t]-.*$   but when writing elisp code you need to double escape everything like so:   ^\\(.*\\)[\t]-.*$     I finally found a reference to this in a Steve Yegge , but I was wondering if anyone knew why this is?
89886
According to the , in order to make code more portable, they recommend using something like the following for escaping data:  if (!get_magic_quotes_gpc()) {     $lastname = addslashes($_POST['lastname']); } else {     $lastname = $_POST['lastname']; }   I have other validation checks that I will be performing, but how secure is the above strictly in terms of escaping data? I also saw that magic quotes will be deprecated in PHP 6. How will that affect the above code? I would prefer not to have to rely on a database-specific escaping function like mysql_real_escape_string().
17694
I can read the MySQL documentation and it's pretty clear. But, how does one decide which character set to use? On what data does collation have an effect?  I'm asking for an explanation of the two and how to choose them.
24749
At the moment, I apply a 'throw everything at the wall and see what sticks' method of stopping the aforementioned issues. Below is the function I have cobbled together:  function madSafety($string) {  $string = mysql_real_escape_string($string); $string = stripslashes($string); $string = strip_tags($string); return $string;  }   However, I am convinced that there is a better way to do this. I am using FILTER_ SANITIZE_STRING and this doesn't appear to to totally secure.   I guess I am asking, which methods do you guys employ and how successful are they? Thanks
23809
How do I escape the underscore character?  I am writing something like the following where clause and want to be able to find actual entries with _d at the end.  Where Username Like '%_d'
12526
Would you recommend using a  or a  field, and why (using MySQL)?   I'm working with PHP on the server side.
103530
I'm wondering if there is a "best" choice for collation in MySQL for a general website where you aren't 100% sure of what will be entered? I understand that all the encodings should be the same, such as MySQL, Apache, the HTML and anything inside PHP.  In the past I have set PHP to output in "UTF-8", but which collation does this match in MySQL? I'm thinking it's one of the UTF-8 ones, but I have used utf8_unicode_ci, utf8_general_ci, and utf8_bin before.
13909
When encoding a query string to be sent to a web server - when do you use escape() and when do you use encodeURI() or encodeURIComponent():  Use escape:  escape("% +&amp;=");   OR  use encodeURI() / encodeURIComponent()  encodeURI("http://www.google.com?var1=value1&amp;var2=value2");  encodeURIComponent("var1=value1&amp;var2=value2");