top | item 40263339

(no title)

espinielli | 1 year ago

As if database were not able to del with apostrophes or other special characters... Yes you have to sanitize your queries, but you have to do it anyway. Client applications will of course have to be smarter

discuss

order

charlieo88|1 year ago

As someone with an apostrophe in my name, it has been my experience whenever I come across this sort of thing, you can be sure the project is crap.

arrowsmith|1 year ago

It's like the stories of people with the last name "Null" who get errors when trying to enter their name into websites. If that's true then I don't want to think about how poorly built (and insecure) those systems must be.

bombcar|1 year ago

Legally change your name to have \’ such as D\’Armond.

That should break untold numbers of systems.

refset|1 year ago

H2 offers quite a comprehensive solution for dealing with this:

> [H2] provides a way to enforce usage of parameters when passing user input to the database. This is done by disabling embedded literals in SQL statements. To do this, execute the statement:

> SET ALLOW_LITERALS NONE;

> Literals can only be enabled or disabled by an administrator

https://www.h2database.com/html/advanced.html

lyu07282|1 year ago

I would argue if you sanitize your input you are already doing it wrong, you should parameterize queries and send the data entirely separately from code.

swasheck|1 year ago

from a certain perspective, parameterization could be seen as sanitation, no?

ginko|1 year ago

I think part of the problem with apostrophes is also that there's two characters for it. ' and ’

ahazred8ta|1 year ago

The Hawaiʻian ʻokina symbol begs to differ...

dark-star|1 year ago

My keyboard has at least 3 already: ` ´ and ' ...

I guess there are lots more in other languages...

chrisjj|1 year ago

And now they've added the problem of some roads having two names. Such as the example in the article's first photo.

secondcoming|1 year ago

There’s not though. My iPad gives this one, but that’s probably the fault of Apple thinking they know better.