Ruby, MySQL, and apostrophe problem

Ruby
1

I’m building a website for a university class that allows users to
submit links (though not “rank” them) a la Digg. The entire page is
built on a CGI script and uses HTML input fields, as well as a textarea.

Everything seems to work fine, except that if a user inputs an
apostrophe in any field of the form, the script breaks.

Is there some way of handling this, or do I need to warn people to not
use conjunctions or possessives?

Thanks so much.

2

On 2/11/08, Mark A. [email protected] wrote:

I’m building a website for a university class that allows users to
submit links (though not “rank” them) a la Digg. The entire page is
built on a CGI script and uses HTML input fields, as well as a textarea.

Everything seems to work fine, except that if a user inputs an
apostrophe in any field of the form, the script breaks.

Is there some way of handling this, or do I need to warn people to not
use conjunctions or possessives?

Escape any user-supplied data you put into a SQL query.

Google up on SQL injection for more.

Best,
jeremy

3

Jeremy K. wrote:

On 2/11/08, Mark A. [email protected] wrote:

I’m building a website for a university class that allows users to
submit links (though not “rank” them) a la Digg. The entire page is
built on a CGI script and uses HTML input fields, as well as a textarea.

Everything seems to work fine, except that if a user inputs an
apostrophe in any field of the form, the script breaks.

Is there some way of handling this, or do I need to warn people to not
use conjunctions or possessives?

Escape any user-supplied data you put into a SQL query.

Google up on SQL injection for more.

Best,
jeremy

Sorry, but how exactly do I escape the data?

Basically, the code is this

description = $cgi[‘description’]

HTML stuff

puts #{description#}

Thanks again.

4

On 2/11/08, Mark A. [email protected] wrote:

use conjunctions or possessives?
Basically, the code is this

description = $cgi[‘description’]

HTML stuff

puts #{description#}

You need to investigate this and figure it out yourself, my friend :slight_smile:

jeremy

5

Is there some way of handling this, or do I need to warn people to not
use conjunctions or possessives?

Just use Sequel and forget about SQL injection:

http://sequel.rubyforge.org

If you need more help we are here:

http://groups.google.com/group/sequel-talk

best
sharon