Insert HTML data into the SQL Server

Question

I have a problem about inserting HTML data into SQL Server. here are the details:

this is my stored procedure;

@articleID int,
@articleBody nvarchar(max)
AS

UPDATE v2_Articles SET articleBody = @articleBody WHERE articleID = @articleID

and this is my asp code for inserting data;

x_articleBody = Replace(Replace(Request.Form("x_articleBody"), CHR(34), """"), "'", """")

Connection.Open(ConnStr)
Connection.Execute("EXEC InsertBody @articleID = " & aID & ", _
@articleBody = '" & x_articleBody & "'")            
Connection.Close()

and this is my data for insert;

<font> TEXT TEXT &nbsp;&nbsp; TEXT TEXT</font>

So, problem is: when I try this, data saving until

&nbsp;

it means after the process sql table is changing like;

<font> TEXT TEXT

Is there any idea about that?

ps. I'm using nicedit text editor for generating html data.

This is all kinds of bad. Why save HTML in a database? Are you validating your arguments? How do you keep from saving malicious HTML? You should use an sproc and not dynamic SQL. Etc. etc. — n8wrl
– n8wrl, Commented Apr 13, 2011 at 11:10
because no one can insert any malicious HTML, this is local application and none of pages accessible except admin=)) — Serdar Uyanik
– Serdar Uyanik, Commented Apr 13, 2011 at 11:53

Kon · Accepted Answer · 2011-04-13 11:07:54Z

2

First of all, do not use embedded SQL - you are causing yourself extra headaches by doing that, because you have to go through this data cleansing mess and you're exposing your application to potential SQL Injection.

Create a stored procedure that takes text as a parameter, and use that to save your HTML markup.

answered Apr 13, 2011 at 11:07

Kon

27.5k12 gold badges64 silver badges87 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Serdar Uyanik Over a year ago

thank you Kon, could you please advise about taking text as a parameter=)

Collectives™ on Stack Overflow

Insert HTML data into the SQL Server

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related