From: Mark Adkins <kaujot@...>
Date: 2008-02-12T10:23:53+09:00
Subject: Re: Ruby, MySQL, and apostrophe problem

Jeremy Kemper wrote:
> On 2/11/08, Mark Adkins <kaujot@gmail.com> wrote:
>> I'm building a website for a university class that allows users to
>> submit links (though not "rank" them) a la Digg. The entire page is
>> built on a CGI script and uses HTML input fields, as well as a textarea.
>>
>> Everything seems to work fine, except that if a user inputs an
>> apostrophe in any field of the form, the script breaks.
>>
>> Is there some way of handling this, or do I need to warn people to not
>> use conjunctions or possessives?
> 
> Escape any user-supplied data you put into a SQL query.
> 
> Google up on SQL injection for more.
> 
> Best,
> jeremy

Sorry, but how exactly do I escape the data?

Basically, the code is this

description = $cgi['description']

HTML stuff

puts #{description#}

Thanks again.

-- 
Posted via http://www.ruby-forum.com/.