If you feel you can make use of it, this might be a place to
start:
[^-_,\.@a-zA-Z0-9\s]
I use this reg exp as part of a parameter to an refindnocase
function inside a little udf I wrote to scrub user input. It's not
the entire expression, and I don't feel comfortable simply posting
the whole udf (not trying to be mysterious, but it's part of our
online security, after all, and is the property of my employer).
I think your approach of defining allowable characters,
instead of trying to define non-allowable ones, makes a great deal
of sense and is the approach that seems to be widely recommended.
That's what I use the expression above to do...if the character
ain't in that set, it gets deleted from the input string. It can
extract a price even from an innocent string, though...note that if
a user inputs "O'Brien" it'll come through as "OBrien" which for my
purposes is no more than a minor inconvenience. YMMV.
If that code makes no sense, spend an hour reading up on Reg
Expressions and you'll get it.
Bob's advice to become familiar with cfqueryparam is, of
course, excellent.
3
Replies
AdChoices