views:

26

answers:

1

I need to make a form with a Text Area that accepts lines of script, any kind of script be it javascript, css, html, vbscript, whatever. How can the script be passed to a form post?

EDIT: How can this script be modified so it can be inserted into a Database? Specifically SQL Server 2005

+1  A: 
T.J. Crowder
That is true however in the process of saving this information to a database, it being a script is causing all sorts of havok with the SQL Statement. That's what I really need help with.
William Calleja
@William: It sounds as though you're not pre-processing the text correctly, which has all sorts of implications, not least making the app susceptible to SQL injection attacks: http://en.wikipedia.org/wiki/Sql_injection, http://imgs.xkcd.com/comics/exploits_of_a_mom.png The solution is the same for script as for other text, use a parameterized statement when doing your SQL insert/update (whatever those look like in your environment; for instance, in Java you might use `java.sql.PreparedStatement`). If you search for "SQL Injection" on SO (or generally) you'll find tutorials about it.
T.J. Crowder
Thanks a lot T.J. I really wasn't giving sql injection any though tat all.
William Calleja
@William: Glad that helped!
T.J. Crowder