开发者

How can a Script be passed through a TextArea into a Form?

I need to make a form with a Text Area that accepts lines of script, any kind of script be it 开发者_JAVA技巧javascript, css, html, vbscript, whatever. How can the script be passed to a form post?

EDIT: How can this script be modified so it can be inserted into a Database? Specifically SQL Server 2005


In the normal way, it's just text. It only becomes "script" when you ask a script interpreter to interpret it (or a compiler to compile it; these lines are getting blurrier and blurrier). So you can include it in your form in exactly the same way you would if it were where someone should type anything else — a forum post, a question, an answer, a brief description of their job, a love letter... :-)

Edit Re your edit follow-up, what you need to do is properly pre-process the text. This doesn't only relate to script, you run into issues with normal text too. Here are some links addressing this in the context of SQL injection attacks, but the techniques are the same whether you're defending against SQL injection or just trying to support having a single quote in someone's name.

Starting with a fun comic:

http://imgs.xkcd.com/comics/exploits_of_a_mom.png

...and then referencing some useful stuff:

http://en.wikipedia.org/wiki/Sql_injection

Classic ASP SQL Injection Protection

How can I avoid SQL injection attacks?

Can I protect against SQL Injection by escaping single-quote and surrounding user input with single-quotes?

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜