anyone familiar with MAKEFORMMAIL.CGI ?

[Food Groupy]

I use this script for a simple feedback form.

funny thing is, when I receive comments from a "text area" message, they are
usually missing any apostrophe's or quotation marks that are included in the
comments.

any comments on this from folks who know the 'innards' of such things?

thanks,,,,

Franko Dog

 

[Adrienne]

I use this script for a simple feedback form.

funny thing is, when I receive comments from a "text area" message,
they are usually missing any apostrophe's or quotation marks that are
included in the comments.

any comments on this from folks who know the 'innards' of such things?

thanks,,,,

Franko Dog

Sounds like the script is stripping them, or replacing them. The reason is
because the quote or apostrophe is used as a delimiter, so if you have
something like:
joe's restaurant

A script or program might read that as two fields, joe and s restaurant.

 

[Augustus]

I use this script for a simple feedback form.

funny thing is, when I receive comments from a "text area" message, they are
usually missing any apostrophe's or quotation marks that are included in the
comments.

any comments on this from folks who know the 'innards' of such things?

When dealing with user input its always a good idea to strip out any
characters that could possibly break the SQL or server side code

Usually you replace them with codes, like replacing all the " characters
with " but some will just simply remove the potentially bad characters

 

[Whitecrest]

When dealing with user input its always a good idea to strip out any
characters that could possibly break the SQL or server side code
Usually you replace them with codes, like replacing all the " characters
with " but some will just simply remove the potentially bad characters

Or just escape them.

 

[John Bokma]

When dealing with user input its always a good idea to strip out any
characters that could possibly break the SQL or server side code

Usually you replace them with codes, like replacing all the " characters
with " but some will just simply remove the potentially bad characters

There is no need if you use ? in your query, and provide the data as
parameters. "INSERT (?,?,?) INTO table" works perfectly, no need for
escaping.

My best guess, this script is crap, like most of the CGI scripts
floating around.