I'm trying to sanitize a date sent from jquery's datepicker before inserting it into a mysql database but I can't seem to get it to work. Can anyone tell me what I'm doing wrong? Thanks.  //Pull date from datepicker  $date=$_POST['date'];  //Convert to date for mysql insertion $mydate = date ("Y-m-d", strtotime($date));  $clean_date = preg_replace("([^0-9/])", "",$mydate);
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
86157
I was trying to add the column of MYSQL Timestamp to the Database Table, the Query seems to be working correctly in mysql console.But when I execute the same in db_query() the following error is thrown.     Failed: PDOException: SQLSTATE[42000]: Syntax error or access   violation: 1067 Invalid default value for 'last_update_date': ALTER   TABLE stores ADD last_update_date TIMESTAMP NOT NULL DEFAULT   '0000-00-00 00:00:00';; Array ( ) in store_update_7100() (line 254 of   /var/www/slocamo_app/sites/all/modules/store/store.install).   Is the Query.  ALTER TABLE  `stores` ADD  `last_update_date` TIMESTAMP NOT NULL DEFAULT  '0000-00-00 00:00:00');
50605
How do I save user-entered line breaks from a &lt;textarea&gt; HTML element to a database?  It always removes the line breaks.
17730
Is there a catchall function somewhere that works well for sanitizing user input for SQL injection and XSS attacks, while still allowing certain types of HTML tags?
17027
I'm trying to write a regular expression that validates a date.  The regex needs to match the following   M/D/YYYY MM/DD/YYYY Single digit months can start with a leading zero (eg: 03/12/2008) Single digit days can start with a leading zero (eg: 3/02/2008) CANNOT include February 30 or February 31 (eg: 2/31/2008)   So far I have   ^(([1-9]|1[012])[-/.]([1-9]|[12][0-9]|3[01])[-/.](19|20)\d\d)|((1[012]|0[1-9])(3[01]|2\d|1\d|0[1-9])(19|20)\d\d)|((1[012]|0[1-9])[-/.](3[01]|2\d|1\d|0[1-9])[-/.](19|20)\d\d)$   This matches properly EXCEPT it still includes 2/30/2008 &amp; 2/31/2008.  Does anyone have a better suggestion?  Edit: I found  on RegExLib  ^((((0[13578])|([13578])|(1[02]))[\/](([1-9])|([0-2][0-9])|(3[01])))|(((0[469])|([469])|(11))[\/](([1-9])|([0-2][0-9])|(30)))|((2|02)[\/](([1-9])|([0-2][0-9]))))[\/]\d{4}$|^\d{4}$   It matches all valid months that follow the MM/DD/YYYY format.  Thanks everyone for the help.
20766
User equals untrustworthy. Never trust untrustworthy user's input. I get that. However, I am wondering when the best time to sanitize input is. For example, do you blindly store user input and then sanitize it whenever it is accessed/used, or do you sanitize the input immediately and then store this "cleaned" version? Maybe there are also some other approaches I haven't though of in addition to these. I am leaning more towards the first method, because any data that came from user input must still be approached cautiously, where the "cleaned" data might still unknowingly or accidentally be dangerous. Either way, what method do people think is best, and for what reasons?
76394
I need to do a date comparison in Mysql without taking into account the time component i.e. i need to convert '2008-11-05 14:30:00' to '2008-11-05'  Currently i am doing this:  SELECT from_days(to_days(my_date))   Is there a proper way of doing this?
2174
I've got a huge list of date-times like this as strings:  Jun 1 2005  1:33PM Aug 28 1999 12:00AM   I'm going to be shoving these back into proper datetime fields in a database so I need to magic them into real datetime objects.   This is going through Django's ORM so I can't use SQL to do the conversion on insert.
17462
I find it curious that the most obvious way to create Date objects in Java has been deprecated and appears to have been "substituted" with a not so obvious to use lenient calendar.  How do you check that a date, given as a combination of day, month, and year, is a valid date?  For instance, 2008-02-31 (as in yyyy-mm-dd) would be an invalid date.
17519
I have a string containing the , and I need to convert it to a Java Date object.  String date = "1081157732"; DateFormat df = new SimpleDateFormat(""); // This line try {   Date expiry = df.parse(date);  } catch (ParseException ex) {   ex.getStackTrace(); }   The marked line is where I'm having trouble. I can't work out what the argument to SimpleDateFormat() should be, or even if I should be using SimpleDateFormat().
53567
I have a query which is meant to show me any rows in table A which have not been updated recently enough. (Each row should be updated within 2 months after "month_no".):  SELECT A.identifier      , A.name      , TO_NUMBER(DECODE( A.month_no              , 1, 200803               , 2, 200804               , 3, 200805               , 4, 200806               , 5, 200807               , 6, 200808               , 7, 200809               , 8, 200810               , 9, 200811               , 10, 200812               , 11, 200701               , 12, 200702              , NULL)) as MONTH_NO      , TO_NUMBER(TO_CHAR(B.last_update_date, 'YYYYMM')) as UPD_DATE   FROM table_a A      , table_b B  WHERE A.identifier = B.identifier    AND MONTH_NO &gt; UPD_DATE   The last line in the WHERE clause causes an "ORA-00904 Invalid Identifier" error. Needless to say, I don't want to repeat the entire DECODE function in my WHERE clause. Any thoughts? (Both fixes and workarounds accepted...)
20307
I'm not sure if this gets the past date within the current day or if it only takes 30 or 31 days to it.  e.g.  If the current date is March 28th, 1 month ago must be February 28th, but what happen when it's March 30th?  Scenario  I want to backup some files each day, the script will save this files within the current date with $(date +%Y%m%d) format, like 20150603_bckp.tar.gz, then when the next month arrives, remove all those files within 1 month ago except the 1st's and the 15th's files, so this is my condition:  past_month = $(date -d "-1 month" +%Y%m%d) day = $(date +%d) if [ "$day" != 01 ] &amp;&amp; [ "$day" != 15 ] then     rm /path/of/files/${past_month}_bckp.tar.gz     echo "Depuration done" else     echo "Keep file" fi   But I want to know, what will happen when the date is 30th, 31th or even the past February example? It will keep those files? or remove day 1st files?  When it's 31th the depuration will execute, so if the past month only had 30 days, this will remove the day 1st file?   I hope I hinted.
79605
I have an issue -   The javascript Date("mm-dd-yyyy") constructor doesn't work for FF.  It works fine for IE.   IE : new Date("04-02-2008") => "Wed Apr 2 00:00:00 EDT 2008" FF2 : new Date("04-02-2008") => Invalid Date       So lets try another constructor. Trying this constructor Date("yyyy", "mm", "dd")   IE : new Date("2008", "04", "02"); => "Fri May 2 00:00:00 EDT 2008" FF : new Date("2008", "04", "02"); => "Fri May 2 00:00:00 EDT 2008" IE : new Date("2008", "03", "02"); => "Wed Apr 2 00:00:00 EDT 2008" FF : new Date("2008", "03", "02"); => "Wed Apr 2 00:00:00 EDT 2008"   So the Date("yyyy", "mm", "dd") constructor uses an index of 0 to represent January.   Has anyone dealt with this? There must be a better way than subtracting 1 from the months.
12656
How do you set a default value for a MySQL Datetime column?  In SQL Server it's getdate(). What is the equivalant for MySQL? I'm using MySQL 5.x if that is a factor.
46064
How can I go about displaying a date that is formatted to a users locale, for example me and my Australian friends use the format dd/MM/yyyy, while the Americans amoung us use MM/dd/yyyy. I know I can format a date in visualforce like so  &lt;apex:outputText value="{0,date,dd/MM/yyyy}"&gt;     &lt;apex:param value="{!myDateValue}" /&gt;  &lt;/apex:outputText&gt;   but how can I use the salesforce locale,   but how can I use these on my page?  I have found a very comprehensive solution , but I was hoping someone new of an inbuilt, or more elegant way.
67275
I've been using this piece of code I've written and it's working in this most unclear manner. I wish to insert a row into the database which includes two columns of DateTime:  myrow.ApprovalDate = DateTime.Now myrow.ProposedDate = DateTime.Now   And yet, when I update the database I receive this error:     SqlDateTime overflow. Must be between 1/1/1753 12:00:00 AM and 12/31/9999 11:59:59 PM.    I've even tried copying an inserted value from the database and hard code it into the object being updated:  // I copied this value from the DB myrow.ApprovalDate =  Convert.ToDateTime("2008-12-24 00:00:00.000");   Still same error, the strange part is that the above trick worked for the first insert to the DB but failed from there on. Any ideas what's going on?
15099
Say I have a string coming in, "2007-02-28", what's the simplest code I could write to turn that into "2007-03-01"? Right now I'm just using strtotime(), then adding 24*60*60, then using date(), but just wondering if there is a cleaner, simpler, or more clever way of doing it.