List Info

Thread: RE: Scrubbing user inputs




RE: Scrubbing user inputs
country flaguser name
United States
2008-07-19 18:45:24
Will paste special work?


Regards
Amin Adatia( aminknowtech.ca )
KnowTech Solutions Inc. ( www.knowtech.ca )
+1.613.226.8378  Mobile +1.613.864.8378

-----Original Message-----
Monty Latiolais
Sent: Sat July-19-2008 16:05
To: Multiple recipients of list ODTUG-WEBDEV-L

Thanks for all the input.

I was able to scrub it on the server-side, by using 

l_user_commts :=
regexp_replace(l_value(i),'%u2022|%uF0A7|%uF076',null);

and as John pointed out...losing the bullets.

I'm not happy with my approach because I'll continually have
to chase
it.
I've only handled the bullet issue. Other things pasted
directly out of
MS Word will present ongoing problems. 

Michelle, like you, I would love to make this a training
issue and not
allow direct cut/paste from MS Word - but I don't think
that's one I
could win.


Monty Latiolais
monty.latiolaispublicans.com



-----Original Message-----
Michelle, Suzanne
Sent: Friday, July 18, 2008 8:31 PM
To: Multiple recipients of list ODTUG-WEBDEV-L

I am very interested in this problem, because eventually I
will face it
too ... users cutting / pasting from MS Word ... what about
some sort of
LOB type field? what if users want their formatting
preserved? what
about some sort of convert to RTF type data first? (and
telling users
they will not be allowed to paste from Word [<hah> my
editorial self
says, they'll like THAT] ... but must first save their data
as rich
text)

Suzanne ( 2Bwy A13.32)
desk: 646-252-8663, cell: 347-907-1125

-----Original Message-----
John Caputo
Sent: Friday, July 18, 2008 8:51 PM
To: Multiple recipients of list ODTUG-WEBDEV-L

The problem here is the text pasted from MS Word IS NOT pure
text. It is
binary as well as text. On the upload, it goes in the DB
fine. When
retrieved and sent to HTML, it barfs on the binary stuff
imbedded within
the MS Word content. You can scrub all the binary stuff you
don't want,
but the user might not be happy. The way MS word creates the
bullet is
binary. So the scrubbed text will ose the bullets.

John Caputo
johnjcsurewest.net
 

---- Original message ----
>Date: Fri, 18 Jul 2008 14:55:28 -0800
>From: "Raymond De Bruyn" <rdebruynsympatico.ca>
>Subject: RE: Scrubbing user inputs
>To: Multiple recipients of list ODTUG-WEBDEV-L 
><ODTUG-WEBDEV-Lfatcity.com>
>
>   It's hard to tell what's happening without code, but
I assume you
are getting a
>   successful post and are failing on the redirect. I
work in PLSQL Web
Toolkit
>   every day and my code for submit is typically:
>
>   initialize
>
>   perform dml operations
>
>   owa_util.redirect_url
>
>   If this is what you're doing try commenting out the
owa_util.redirect_url and
>   just do an htp.p of the url you've built. Run the
form with a pasted
value
>   you've identified as causing the error. Then look at
the url
provided.
>
>   At one point we had a form that echoed all parameters
back to the
original form
>   when the dml failed. It worked ok unless the user
added too much
text to the
>   comments field. The URL built was too long and
failed. It seems you
can go to
>   about 1500 characters before the URL fails.
>
>   Since you had a PLSQL error, you may be doing an
encode URL that's
throwing the
>   error.
>
>   Hope this helps,
>   Ray
>
>     
>
------------------------------------------------------------
----------
> ------
>
>     Hello all,
>
>      
>
>     I've built a simple html form using the pl/sql web
toolkit that
has a place
>     for the user to include comments.
>
>     It's been in production for months if not years.
>
>      
>
>     Recently, we've experienced errors related to the
content of the
comments
>     and I've traced it to users cutting and pasting
content from MS
Word
>     directly into the web form comments field.
>
>     Even that is fine except for when the user attempts
to paste in
bullets.
>
>      
>
>     I'll have to handle this on the client-side. Any
ideas?
>
>      
>
>      
>
>     Regards,
>
>      
>
>     Monty
>
>   -- For more information on this topic or to become a
member, visit
our Web site
>   at http://www.ODTUG.com Join
ODTUG for The PL/SQL and The APEX
Expert Gathering
>   of the Year! OPP2008 and APEXposed! 2008 will be held
on October
29-30, 2008 at
>   the Wyndham O'Hare, Chicago. Visit www.odtugopp.com
or
www.odtugapextraining.com
>   for more details. -- Author: Raymond De Bruyn INET:
rdebruynsympatico.ca Fat
>   City Hosting, San Diego, California -- http://www.fatcity.com
>
------------------------------------------------------------
--------- To
REMOVE
>   yourself from this mailing list, send an E-Mail
message to:
ListGurufatcity.com
>   (note EXACT spelling of 'ListGuru') and in the
message BODY, include
a line
>   containing: UNSUB ODTUG-WEBDEV-L (or the name of
mailing list you
want to be
>   removed from). You may also send the HELP command for
other
information (like
>   subscribing).

--
For more information on this topic or to become a member,
visit our Web
site at http://www.ODTUG.com  

Join ODTUG for The PL/SQL and The APEX Expert Gathering of
the Year!
OPP2008 and APEXposed! 2008 will be held on October 29-30,
2008 at the
Wyndham O'Hare, Chicago. Visit www.odtugopp.com or
www.odtugapextraining.com for more details.
--
Author: John Caputo
  INET: johnjcsurewest.net

Fat City Hosting, San Diego, California -- http://www.fatcity.com
------------------------------------------------------------
---------
To REMOVE yourself from this mailing list, send an E-Mail
message
to: ListGurufatcity.com (note EXACT spelling of 'ListGuru') and
in the
message BODY, include a line containing: UNSUB
ODTUG-WEBDEV-L (or the
name of mailing list you want to be removed from).  You may
also send
the HELP command for other information (like subscribing).

-- 
For more information on this topic or to become a member,
visit our Web
site at http://www.ODTUG.com  

Join ODTUG for The PL/SQL and The APEX Expert Gathering of
the Year!
OPP2008 and APEXposed! 2008 will be held on October 29-30,
2008 at the
Wyndham O'Hare, Chicago. Visit www.odtugopp.com or
www.odtugapextraining.com for more details.
-- 
Author: Michelle, Suzanne
  INET: Suzanne.Michellenyct.com

Fat City Hosting, San Diego, California -- http://www.fatcity.com
------------------------------------------------------------
---------
To REMOVE yourself from this mailing list, send an E-Mail
message
to: ListGurufatcity.com (note EXACT spelling of 'ListGuru') and
in
the message BODY, include a line containing: UNSUB
ODTUG-WEBDEV-L
(or the name of mailing list you want to be removed from). 
You may
also send the HELP command for other information (like
subscribing).

-- 
For more information on this topic or to become a member,
visit our Web site
at http://www.ODTUG.com 


Join ODTUG for The PL/SQL and The APEX Expert Gathering of
the Year! OPP2008
and APEXposed! 2008 will be held on October 29-30, 2008 at
the Wyndham
O'Hare, Chicago. Visit www.odtugopp.com or
www.odtugapextraining.com for
more details.
-- 
Author: Monty Latiolais
  INET: Monty.Latiolaispublicans.com

Fat City Hosting, San Diego, California -- http://www.fatcity.com
------------------------------------------------------------
---------
To REMOVE yourself from this mailing list, send an E-Mail
message
to: ListGurufatcity.com (note EXACT spelling of 'ListGuru') and
in
the message BODY, include a line containing: UNSUB
ODTUG-WEBDEV-L
(or the name of mailing list you want to be removed from). 
You may
also send the HELP command for other information (like
subscribing).

-- 
For more information on this topic or to become a member,
visit our Web site at http://www.ODTUG.com  

Join ODTUG for The PL/SQL and The APEX Expert Gathering of
the Year! OPP2008 and APEXposed! 2008 will be held on
October 29-30, 2008 at the Wyndham O'Hare, Chicago. Visit
www.odtugopp.com or www.odtugapextraining.com for more
details.
-- 
Author: Amin Adatia
  INET: amin_adatiahotmail.com

Fat City Hosting, San Diego, California -- http://www.fatcity.com
------------------------------------------------------------
---------
To REMOVE yourself from this mailing list, send an E-Mail
message
to: ListGurufatcity.com (note EXACT spelling of 'ListGuru') and
in
the message BODY, include a line containing: UNSUB
ODTUG-WEBDEV-L
(or the name of mailing list you want to be removed from). 
You may
also send the HELP command for other information (like
subscribing).

[1]

about | contact  Other archives ( Real Estate discussion Medical topics )