Using HTML in a JDBC SQL Insert Statement

Hi all,

I'm attempting to execute a SQL INSERT statement through a rule and am running into a problem. One of the fields in the SQL Server 2000 database is a text field and is used to house html for use in a user interface. I am running into the following error:

XPRESS <invoke> exception:

com.waveset.util.WavesetException: Can't call method sql on class com.waveset.util.JdbcUtil

==> com.waveset.util.WavesetException:

==> java.sql.SQLException: [Microsoft][SQLServer 2000 Driver for JDBC]Invalid parameter binding(s).

The code that I am using is as follows:

<invoke name='sql' class='com.waveset.util.JdbcUtil'>

<map>

<s>type</s>

<s>sqlserver</s>

<s>driverClass</s>

<s>com.microsoft.jdbc.sqlserver.SQLServerDriver</s>

<s>driverPrefix</s>

<s>jdbc:sqlserver</s>

<s>url</s>

<s>jdbc:sqlserver://%h:%p;DatabaseName=%d</s>

<s>host</s>

<s>HOSTNAME</s>

<s>port</s>

<s>1</s>

<s>database</s>

<s>DATABASENAME</s>

<s>user</s>

<s>USERNAME</s>

<s>password</s>

<s>PASSWORD</s>

<s>sql</s>

<s>insert into RQST_TBL (RQST_TXT) values ('<b>hello</b>')</s>

</map>

</invoke>

The code works fine without the html bold tags (<b>) in the statement. Does anyone have any ideas (escape characters, etc.) on how to get the tags to work?

Thanks!

[1830 byte] By [cmulcrona] at [2007-11-26 19:52:30]
# 1
Try this (URL ENCODE Hexademical Format) %3Cb%3E for <b>%3C%2Fb%3E for </b>Tell if it helps.
AlexanderLa at 2007-7-9 22:43:22 > top of Java-index,Web & Directory Servers,Directory Servers...
# 2
I just tried that and it didn't work. While it does allow the code to be successfully input, it is displayed as a literal when viewed in the user interface. Thanks for the idea, though.Anyone else have any ideas?
cmulcrona at 2007-7-9 22:43:22 > top of Java-index,Web & Directory Servers,Directory Servers...
# 3

It's generally not a good idea to allow HTML tags to be stored in a database and displayed verbatim as this can lead to HTML injection vulnerabilities in an application.

Perhaps you can store the data without the HTML and then have another column in the database that indicates formatting. Then the program displaying the information can format the desired HTML output based on a combination of the formatting column and the actual data column

ca_cudmorea at 2007-7-9 22:43:22 > top of Java-index,Web & Directory Servers,Directory Servers...
# 4
instead of <b> you can try& lt; b & gt;remove space after '&'and try .....I hope this should work.....Message was edited by: VipInf
VipInfa at 2007-7-9 22:43:22 > top of Java-index,Web & Directory Servers,Directory Servers...
# 5

ca_cudmore:

I fully agree that having raw HTML in the database is not a best practice, but I'm interfacing with an exisiting database and don't have much room to make changes in the way they do things. Besides, the HTML being used is fairly complex (as far as HTML goes, at least) and creating a formatting schema would be way beyond the timeframe of the project.

VipInf:

That worked great, thanks a lot!

cmulcrona at 2007-7-9 22:43:22 > top of Java-index,Web & Directory Servers,Directory Servers...