Stopping the jQuery blur event within the blur function.

Question

I have a textbox that I am using the blur event to validate the text with a regular expression. If it fails I want the textbox to keep the focus. I know in regular javascript you can say return functionName(); in the onblur event within the actual html control. Is there a way to do something similar when binding the blur event within the $(document).ready() function. Or simply set the focus on "this". Thank you for the help.

$(document).ready(function() {");
    $('input:text.sqlValidation').blur(function() {");
        var sqlInjectionRegX2 = /...Regex.../;
        var value = this.value;
        if (sqlInjectionRegX2.test(value)) {
            alert('The text you have entered may contain malicious code and can not be submitted.');
            this.value = '';
            return false;
        }
        else return true;
    });
});

Answer 1

Isn't it just to set

$(this).focus();

inside of your blur function somewhere?

Answer 2

Using regular expressions in Javascript to prevent SQL injection is the mother of all (or at least most) evil. DO NOT DO THIS!!! Instead, use parameters in your server side code. If you don't know how, ask us. If you try to prevent SQL Injection the way you're doing it it will not work and you are liable to lose data, or worse. All your enemy needs to do is disable Javascript (or craft his own HTTP request) and your filter will be useless. In addition, I don't think it's possible to fully block SQL injection with a single regex.

---

To answer the question, try writing return false or event.preventDefault() in the handler. However, it won't work perfectly; it is not possible to fully control focus like this in Javascript.

Answer 3

You could prevent the default behavior and stop the event propagation then do this.focus() in the handler. http://docs.jquery.com/Events/jQuery.Event . Any event manipulation should be done before any event handling code.

Answer 4

I think that the best way for you to prevent SQL Injection without rewriting the legacy code to use parameters (this question, which is now closed) would be to double up all quotes and backslashes (replace ' with '' and \ with \\).

Note that I'm not an expert in SQL syntax, so I cannot guarantee that this would be impenetrable.