Skip to main content
Inspiring
October 17, 2010
Question

Restrict Insert

  • October 17, 2010
  • 3 replies
  • 589 views

I have some idiots I guess that are searching for terms like:

Pollen, pà  à  à     à  à  à    à  à   Ã

And the à etc screws things up...

This is the code I am using now - but i seems that they are still sneaking stuff through...

<cfif #term# does not contain "Ã" or #term# does not contain "ý" or #term# does not contain "Â">

<cfquery name="ins" DATASOURCE="medexplorer">
Insert into currentsearch
(words)
values ('#term#')
</cfquery>

</cfif>

Any ideas on how better to not nsert these search terms?

Thanx

    This topic has been closed for replies.

    3 replies

    Owainnorth
    Inspiring
    October 18, 2010

    When you say "And the à etc screws things up", in what way does it do that? Surely it would just not return them any results?

    Miguel-F
    Inspiring
    October 18, 2010

    What he means is don't try to restrict your input by looking for illegal characters.  There are too many options with that methodology.  Instead, only allow valid characters and remove or restrict everything else.  Change your block of code to something like this:

    <cfif IsDefined("form.term") AND Trim(form.term) NEQ "" AND Len(form.term) LTE 50 AND IsValid("regex",form.term,"[\sA-Za-z]*")>

    <cfquery name="ins" DATASOURCE="medexplorer">

    Insert into currentsearch

    (words)

    values (<cfqueryparam cfsqltype="cf_sql_varchar" value="#form.term#" maxlength="50">)

    </cfquery>

    </cfif>

    Please, please, please, always use <cfqueryparam> in your queries as well.  This will save you from some headaches too.  So in my example the regex will only allow capital and lower case letters and spaces.  You can tweak the regex to allow other characters as needed.  I am also limiting the length of the string. Make it the same as you have defined in your database. Good luck!

    Inspiring
    October 18, 2010

    To complicate things further, decide what you want to allow before you start coding it.  For example, do you want to allow these words?

    entrée

    garçon

    what about just the character é?  or the character ç?  How about the letter a?

    Inspiring
    October 17, 2010

    use regular expressions to restrict the strings to the characters you are willing to allow.

    Inspiring
    October 18, 2010

    Not sure I get what u mean?

    As I am trying to restrict the characters...