HTML - ASP Server Encode (

What are you inserting?
And what is the question?

the data inseted was (1)

I got back -

(1)

which when rendered displayes like (1)

How do I correct this, whilst still encoding my html and also protecting my sql?

thank you

If the value is "Robert (Bob)" then

ProtectSQL returns "Robert (Bob)"
HTMLEncode(ProtectSQL) encodes the & as &
Thusly, you get "Robert &amp40;Bob&amp41;"

If you do not desire such a result, you can remove the conversion of the () to after you have HTMLEncoded it.

e.g.,
value = FixParens(Server.HTMLEncode(ProtectSQL(UploadFormRequest("name")))

where ProtectSQL is
Function ProtectSQL(SQLString)
SQLString = Replace(SQLString, "'", "''")
SQLString = Replace(SQLString, vblf,"<br />")
SQLString = Trim(SQLString)
ProtectSQL = SQLString
End Function

and FixParens is
Function FixParens(SQLString)
SQLString = Replace(SQLString, "(","&#40;")
SQLString = Replace(SQLString, ")","&#41;")
SQLString = Trim(SQLString)
FixParens = SQLString
End Function

Or
you can do as I do, and reverse everything.

Function ProtectSQL(SQLString)
SQLString = Replace(SQLString, "'", "''")
SQLString = Replace(SQLString, vblf,"<br />")
SQLString = Replace(SQLString, "(","&#40;")
SQLString = Replace(SQLString, ")","&#41;")
SQLString = Trim(SQLString)
ProtectSQL = SQLString
End Function

Function ReverseSQL(SQLRev)
SQLRev = Replace(SQLRev, "''", "'")
SQLRev = Replace(SQLRev,"<br />", vblf)
SQLRev = Replace(SQLRev,"&#40;", "(")
SQLRev = Replace(SQLRev,"&#41;", ")")
SQLRev = Trim(SQLRev)
ReverseSQL = SQLRev
End Function

Select allOpen in new window

You protect your inserted code with ProtectSQL()
And then to display it back to the page as ReverseSQL()

This keeps the code in place and protected.

Hi Guys,

Sorry, being dumb here -

Nap0leon, does your solution still protext the SQL statement from injection?

CarrzKiss I don't have &#40; I have &amp;#40;

Sorry if I'm being dumb

I am trying to reproduce it and I cannot.
You are writing (1) or (40) and you are getting that value.

Remove the HTMLEncode and see if that will correct it and let me know.

thank you