Escaping special characters in Javascript to use them in MySql

Question

I have gone through a variety of questions that have been asked with the same thing in mind but it doesn't seem to be working for me.

I have a HTML textarea from which I collect the comments of a user and I'm storing them in a MySql database. So I want the special characters that are entered by the users to also be accepted without any error/exception and store them in the database as well.

I came across a solution for the newline character and I added this line of code which works well.

var comment = document.getElementById("commentArea").value;
comment = comment.replace(/\n/g, '<br />');

The other characters like &$%#( are all getting inserted without any problem except for quotes. I'm not sure what should I do to escape them. I tried comment.replace("\'","&39") for escaping single quotes but that doesn't seem to work.

How can I escape both single and double quotes? Thanks in advance.

EDIT: I'm using Jsp and Servlets for my application. Should I escape these characters in the servlet then?

Let me know the reason before downvoting.

Update: As suggested in the answers and comments, I used a prepared statement and passed the string using the setString() method. However, the problem still persists.

The code snippet I've used is:

String query = "insert into db_name (column1,column2,column3,column4) values("SomeValue1","SomeValue2",?,"SomeValue3")";
st=conn.prepareStatement(query);
st.setString(1,"String_from_TextArea");
int rows = st.executeUpdate();

What driver you use? NodeJs, PHP? You must escape the value on the server side(not the client side). — Andrew
– Andrew, Commented Dec 5, 2013 at 7:18
Forget about doing this on the client side. Within the server-side code you need to use mysqli_real_escape_string before writting the comment to the database. — user2417483
– user2417483, Commented Dec 5, 2013 at 7:18
This really should be done on the server-side, rather than the client side. For instance, if you are using PHP, then you can escape the string using PHP's addslashes: cl1.php.net/addslashes If this is not an option, why must it be done by the client? — Matt
– Matt, Commented Dec 5, 2013 at 7:18
Don't MySQL escape in Javascript on the client! You need to escape on the server while you are creating your queries, no sooner, no later! Read kunststube.net/escapism. — deceze
– deceze ♦, Commented Dec 5, 2013 at 7:18

Elon Than · Accepted Answer · 2013-12-05 07:19:15Z

3

There is no need to escape anything in JavaScript, you'll not insert it directly but via some kind of server-side script (like PHP). That's place to perform such tasks. Especially that you can never trust anything that is done using JavaScript. User can modify it easily or even disable JavaScript. That shouldn't brake your site or database!

On server-side you can use prepared statements to safely insert data to database.

answered Dec 5, 2013 at 7:19

Elon Than

9,8254 gold badges29 silver badges37 bronze badges

Sign up to request clarification or add additional context in comments.

12 Comments

Anjan Baradwaj Over a year ago

So I escape them in the Servlet? Using the replace() method?

Elon Than Over a year ago

@AnjanBaradwaj No, don't use something that is not create for escaping. I don't know what server-side language you are using so I can't tell you what it will be exactly but probably there is some dedicated functions for that.

Elon Than Over a year ago

@AnjanBaradwaj Didn't see last edit. You should use Hibernate Query object with parameters and set* methods on it (if you use Hibernate to contact with database).

user2864740 Over a year ago

@AnjanBaradwaj Don't escape for "storing in a database" - do escape when using in output (e.g. HTML). Java/JDBC/Hibernate/etc support placeholders just fine.

Rik Over a year ago

@ElonThan with technologies such as Node.js around, especially considering this question wasn't tagged php and was asked since Node.js has been around, stating that one should never escape characters for storage into a database via javascript, and the other points you've made regarding javascript aren't exactly true: one cannot disable server-side javascript from their computer browser - nor can a client modify server-side javascript. However, when tools such as prepared statements exist, even when using Node.js, escaping is indeed less predictable and recommended against.

|

Rakesh Gopal · Accepted Answer · 2013-12-05 07:27:03Z

0

If you want to URI encode the string, you can use encodeURIComponent() and decodeURIComponent() functions. This is a link to the documentation page of the function.

http://www.w3schools.com/jsref/jsref_encodeuricomponent.asp

Hope that helps.

answered Dec 5, 2013 at 7:27

Rakesh Gopal

5905 silver badges11 bronze badges

Collectives™ on Stack Overflow

Escaping special characters in Javascript to use them in MySql

2 Answers 2

12 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

12 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related