From: Jeremy Kemper <jeremy@...>
Date: 2008-02-12T10:11:56+09:00
Subject: Re: Ruby, MySQL, and apostrophe problem

On 2/11/08, Mark Adkins <kaujot@gmail.com> wrote:
> I'm building a website for a university class that allows users to
> submit links (though not "rank" them) a la Digg. The entire page is
> built on a CGI script and uses HTML input fields, as well as a textarea.
>
> Everything seems to work fine, except that if a user inputs an
> apostrophe in any field of the form, the script breaks.
>
> Is there some way of handling this, or do I need to warn people to not
> use conjunctions or possessives?

Escape any user-supplied data you put into a SQL query.

Google up on SQL injection for more.

Best,
jeremy