Help with JavaScript

General Forums Off-topic Chat
1

Need a smidge of help with some javascript, if there’re any xperts out there… (sorry if this is the wrong forum… mods/admins feel free to move it…)

I’m working on a VBScript/ASP/Access database web-based system and since MS Access SQL hates apostrophes, I’m having to use a little javascript “onclick” function to filter entries to replace single apostrophes (’) with doubles (’’). It works fine, except… when a user puts more than one apostrophe in the entry string (e.g. “It’s a cow’s head!”) the filter catches only the first instance, and a lovely error page appears. Is there anyone out there who might be able to help me tweak this code to catch multiple instances? (I’m not at all anywhere near an expert in this, so please type slowly! :wink: )

Here’s what I’m currently using:

<script type="text/javascript">
function formfilter() 
{
    for (i=0; i<document.forms[0].elements.length; i++) 
    {
        var tmp=document.forms[0].elements[i].value;
        if(tmp.match("'"))
        {
        var ne=tmp.replace("'","''");
        document.forms[0].elements[i].value=ne;
        }
    }
}
</script>

BTW, please refrain from snide posts about how I should be using PHP/MySQL or some such… I’m well aware that the tech I’m using sux… its just what I’m familiar with ATM. Be kind. & TIA!

2 
Dim input as String
input = "it's charlie's fault"

Dim output as String
output = Replace(input, "'", "''")

you DO NOT want to do this client side, any hacker worth their salt can do all kinds of fun things with SQL injection

3

1st - what Zero D said. Doing this client side exposes you to SQL injection attacks.

That said … just for understanding of JS replace functionality (but don’t use this for your script, okay.)

var outputVal = inputVal.replace(/'/g,"''");

This sets the pattern to be a global replace (all instances of pattern)

4

Its served to a local network (intranet) only behind company firewall… not a critical data system, and have you ever seen those ads for Monster.com where the guy’s working with a buncha chimps? You get the picture… no worries from coworker meddling 'round here. 'Sides, if someone working here were to get to cracking into IS systems, there’s much higher-stake targets to risk getting fired over than this piddly one.

Got any ASP server-side solutions to point me at, btw?

Thanks for the tip, agent. We’ll see what we can do…

5

umm, the code block was VB.NET … something I don’t actually use

I use C# [asp.net 2.0… yay generics!] for the project where I work [we’re also using microsoft sql server 2005]

6

I had a similar issue with running a javascript replace a little while back.

My solution was putting the replace function in a do while loop like:

var url = document.URL;
do{
	var url = url.replace(/%20/, " ");
}
while (url.match('%20'))

This one was to replace %20 with spaces in a url, but something like this would work for you too.

7

Um. Actually, that’s not a good idea.

The problem is that the replace function (unless told otherwise) only works on the first match. In his example above he wants to replace one single quote with two single quotes. This has a different challenge than replacing something with something completely different.

Using a loop, on the first pass it will see the first single quote, replace it with two single quotes and stop. Then it will go through the loop again. The first single quote from last time will still be there so it will replace it and go through the loop again. Each time, the first quote will be replaced with two and just get bigger and bigger and bigger, etc. (see: infinite loop)

The real solution is to use the correct method for doing a ‘replace all’ which is to construct your match pattern like I outlined above.
/'/g
g meaning ‘global’

8

Hehe… yeah… you’re right :wink: