Re: preventing sql injection
Re: preventing sql injection
- Subject: Re: preventing sql injection
- From: Mike Schrag <email@hidden>
- Date: Thu, 25 Oct 2007 12:06:37 -0400
This one will not work, because % and * are part of the regular _expression_ syntax/
This however, did work: filterString = filterString.replaceAll("[\\*\\%\\?]","");
Character classes in regexs do not actually require escaping, so filterString.replaceAll("[*%?]","") would be what you actually want ... Otherwise I would expect you're probably inadvertently removing backslashes also.
ms |
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Webobjects-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden