»
S
I
D
E
B
A
R
«
Form validation to protect your application related to SQL statement
4月 16th, 2009 by admin

As long as developing my FYP, I keep testing the freshly made components with aggressive attempts. And these days I just find out more about some necessary precautions to avoid the application crash. For my application, like other applications, there are some textboxs or textareas for data entry, and the data will be stored in database. In case you did not handle the data that being sent carefully, what it’s: Validating data that being sent, those careless can crash the application. In my case, I have to handle symbols like apostrophe(’), backslash(\) so as to avoid the backend forming an incorrect format SQL statement to the database.

Normally a SQL statement is:
INSERT INTO `TABLE_NAME` (`data`) VALUSE (’field1′);

If some people feed the data field1 with “Data\”, then the SQL statement will become:
INSERT INTO `TABLE_NAME` (`data`) VALUSE (’data\’);

The backslash symbol will hide the orginal function of apostrophe and make the SQL statement syntax incorrect, error like ‘missing apostrophe’ is resulted.

If the previous example the backslash is replaced as apostrophe, the SQL statement will also be generated error because of an extra apostrophe.
[X] INSERT INTO `TABLE_NAME` (`data`) VALUSE (’data”);
[X] INSERT INTO `TABLE_NAME` (`data`) VALUSE (’da’ta’); //SQL will think that only [da] will be feeded to `data` column meanwhile do not know what [ta] mean in the remaining part of the SQL.

Hence, great care have to be taken into account so as to avoid the application being crashed by somebody whose intention is bad.

More about validation, Flex has provided several validation class. It is sufficient for general use but I am so interested in thinking whether they are useful or not, just a passage about EmailValidator:
http://www.stimuli.com.br/trane/2007/sep/13/email-validation-actionscript-3/


Leave a Reply

You must be logged in to post a comment.

»  Substance: WordPress   »  Style: Ahren Ahimsa