https://forums.webwiz.net/ Copyright (c) 2006-2013 Web Wiz Forums - All Rights Reserved. Sun, 12 Apr 2026 14:30:25 +0000 Mon, 10 Apr 2006 11:30:27 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 12.08 360 https://forums.webwiz.net/RSS_post_feed.asp?TID=19223 https://forums.webwiz.net/forum_images/web_wiz_forums.png https://forums.webwiz.net/ https://forums.webwiz.net/bug-apostrophes-in-username_topic19223_post103739.html#103739 Author: WebWiz-Bruce
Subject: 19223
Posted: 10 April 2006 at 11:30am

Thank-you I shall look into these issues.]]> Mon, 10 Apr 2006 11:30:27 +0000 https://forums.webwiz.net/bug-apostrophes-in-username_topic19223_post103739.html#103739 https://forums.webwiz.net/bug-apostrophes-in-username_topic19223_post103714.html#103714 Author: djlurchg
Subject: 19223
Posted: 10 April 2006 at 5:51am

When I change the username from FOO to FOO'FOO the username gets changed to FOO''FOO.  This is either SQL Injection related or SQL String related.

OK, figured it out. Here's the code from admin_change_username.asp
  <code>
    strNewUsername = formatSQLInput(strNewUsername)
    <code>
     rsCommon.Fields("UserName") = strNewUsername
    <code>

This should be an easy fix. What you did is prepped the input for use in a SQL string where you have to replace single quotation marks with double quotation marks. That's all well and good if you are updating the values through a SQL statement. You obviously aren't in this case. You are opening a recordset and then setting it equal to the new username.

Is this a simple oversight, or should we be looking for other errors like this?

BTW, I'm glad no one has to maintain my code, they'd come to my house and wack me upside the head. Borg, you did a nice job of making the code readable. :)

PS: There is also a bug on the page in this javascript code:
alert('The member \'Foo'''' Foo\' has had their username changedto \'Foo'' Foo\'.');

I always enclose my javascript with double quotes. That would solve _part_ of this issue.




Edited by djlurchg - 10 April 2006 at 5:54am]]> Mon, 10 Apr 2006 05:51:18 +0000 https://forums.webwiz.net/bug-apostrophes-in-username_topic19223_post103714.html#103714