How can I prevent someone from entering in the character " in my JSP?

I have tried using this code to prevent someone from usng quotes and yes it does the remove quotes now. The problem now is that the page does not do the regular submit that it did before. When I click on the submit button I have it simply removes the quotes that I had and does not submit the page for the bean to process the adding of the record to the table.

How can I use a line like this to make sure I remove the quotes and do the regular submit of the page when the button is clicked?

This is the line I have to do the submit:

<td align="center" height="100"><INPUT type="submit" value="Add Resource" name="ActionType" onClick="return checkForm()"></td>

CHEERS at 2007-6-29 11:46:52 >

I think you can try

function checkForm()

{

if (document.formname.fieldname.value.length>0) {

i=document.frm_register.email.value.indexOf(""")

if(i>-1){

alert(document.formname.fieldname.value + " qoute is not allow");document.formname.fieldname.focus();

return false

}

else return true

}else return false

}

liberticide at 2007-6-29 11:46:52 >

function checkForm(){

if(document.forms) {

for(var i=0; i<document.forms.length; i++) {

for(var j=0; j><document.forms.elements.lengh; j++) {

if(((document.forms.elements[j].type"text")||(document.forms.elements[j].type"password"))&&(document.forms.elements[j].value.indexOf(""")==-1)){

alert("Invalid character");

document.forms.elements[j].focus();

return false;

}

}

}

}

return false

}>

liberticide at 2007-6-29 11:46:52 >

I think if you just want to select some row from database with quotes on the sql statement will just fine. The preparestatement will help to escape the quotes and insert the original string which still contain the quotes if you didn't remove it into database.

[code]

PreparedStatement pstmt = con.prepareStatement("UPDATE EMPLOYEES

SET SALARY = ? WHERE ID = ?");

pstmt.setBigDecimal(1, 153833.00)

pstmt.setInt(2, 110592)

[code]

the index is respect to the order of "?"s

liberticide at 2007-6-29 11:46:52 >

> You can't prevent them from entering it, but you can

> stop it being passed on from the text box. You could

> do this from JavaScript or when you parse the

> information after it has been typed in.

In fact, you CAN prevent someone typing a character using javascript. But in case of the " character, this means you also can't type the ' (single quote) character.

In the textbox you assign the onKeyUp() to a javascript function. In my case it is the checkKeyPressed function. Then you create following function in javascript.

function checkKeyPressed() {

if (window.event.keyCode == 222) {

var text = document.mijnForm.inputElement.value;

text = text.substring(0, (text.length - 1));

document.mijnForm.inputElement.value = text;

}

Maybe you should put a beep or something in this method as well, but I do not know how that is done.

regards,

Jeroen.

jewes at 2007-6-29 11:46:52 >