https://forums.webwiz.net/ Copyright (c) 2006-2013 Web Wiz Forums - All Rights Reserved. Thu, 09 Apr 2026 01:18:20 +0000 Fri, 12 May 2006 20:33:19 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 12.08 360 https://forums.webwiz.net/RSS_post_feed.asp?TID=19796 https://forums.webwiz.net/forum_images/web_wiz_forums.png https://forums.webwiz.net/ https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106852.html#106852 Author: djlurchg
Subject: 19796
Posted: 12 May 2006 at 8:33pm

Nice call there borg! I had forgotten about those tricks :)]]> Fri, 12 May 2006 20:33:19 +0000 https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106852.html#106852 https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106834.html#106834 Author: WebWiz-Bruce
Subject: 19796
Posted: 12 May 2006 at 11:28am

Version 6 didn't have the same level of security as version 7 and version 8 has, and didn't encode the user input in the same way.

There are a number of words that are HTML encoded to prevent XSS hacks, these are words such as:-

form
onClick
onMouseOver
vbscript
javascript
cookie
script

and a number of  others, by HTML encoding characters within these words when displayed in a web browser prevents the web browser from executing these statements as events if manipulated by a hacker to do so, thus preventing XXS hacking.
]]> Fri, 12 May 2006 11:28:17 +0000 https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106834.html#106834 https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106833.html#106833 Author: djlurchg
Subject: 19796
Posted: 12 May 2006 at 11:04am

The reason was that I was trying to reproduce the original error. I've no idea how the quotation marks got into the Topic title. I'm guessing that the original poster put them in before I had upgraded to the latest version. At some point in your development cycle (V6?) the input was not converted properly.

---

I just checked by entering a thread topic with quotation marks.
Via the application form (not the mdb table editor) I entered

This is "for" Borg

The resulting databse entry is:

This is "for" Borg

So, it appears to be working.

The problem appears to be: in an old version of the software (which I was using up until V8RC1 came out) the quotation marks did not get converted to HTML encoded format.

Apparently at some point you switched from actually using the correct data (" mark) to another approach (HTML encoded) method to storing data.

----

On a related note, why is one of the field entries in the topic table have a value of:

Custom Forms: Phase 1

Instead of:

Custom Forms: Phase 1

?
]]> Fri, 12 May 2006 11:04:36 +0000 https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106833.html#106833 https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106817.html#106817 Author: WebWiz-Bruce
Subject: 19796
Posted: 12 May 2006 at 8:48am

I'm not sure why you are entering data directly into the database as this circumnavigates the forums 'HTML Secure' engine which parses data inputted into the forum and replaces things like quotes with HTML encoded (&quote), before being written to the database.

If you use the forum in the way it was intended you should never get this problem, also by entering data directly into the database you will course other issues within your forum.

The 'HTML Secure' technology also encodes other characters when parsing user input which is why you get other encoded characters within user input, this is mainly to prevent XXS hacking, but is also useful for preventing other types of hacking.


]]> Fri, 12 May 2006 08:48:47 +0000 https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106817.html#106817 https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106776.html#106776 Author: djlurchg
Subject: 19796
Posted: 11 May 2006 at 2:50pm

Borg:

Sorry, but I presumed the posted steps would reproduce the error.  The steps were based on my superficial analysis of the problem.

I went to the trouble of restoring my forum database from a daily backup to try and recreate the problem. I did some additional debugging and I think I now can provide reproducable steps.

Using the Access DB backend, open the forum database. Open the table that contains the thread titles (tblTopic). Now change the thread title to something like:

This is the "Thread" Title

Now, log on with admin priveledges. Go to the thread with the above mentioned title. Click on the Edit button to edit the thread title.

Voila, the form should display:

The is the

If you look at the source code it will say:

value="This the the "Thread" Title


PS: Another odd thing that I noticed when looking at the tblTopics table was that some characters were URL encoded. For example:

Here is a &0124;ample

Where &024; was equal to S when displayed. The URL code was used for example as I can't remember if it was &023; or &034; or what it was.

]]> Thu, 11 May 2006 14:50:05 +0000 https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106776.html#106776 https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106738.html#106738 Author: WebWiz-Bruce
Subject: 19796
Posted: 11 May 2006 at 10:01am

I've been trying now for about 20 minutes to replicate this error but I can not.

The code should be change quotes (") to &quote; to HTML encode it.

In all tests I have done using your example above it is encoded like this everytime, I have been trying different methods for about 20 minutes, but it is always encoded.

The only thing I can think is that you may have a corrupted file, so try reuploading the original files again.

If the problem persists could you post a step by step guide on how you did this so that I can try and replicate the problem?
]]> Thu, 11 May 2006 10:01:19 +0000 https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106738.html#106738 https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106692.html#106692 Author: djlurchg
Subject: 19796
Posted: 10 May 2006 at 4:46pm

Borg:

Yes, it's me again.

You missed another quotation mark issue.

To reproduce the error log on with admin priveledges (ability to edit posts). Edit the first post in a thread. Change the subject of the thread to something like...  "WWF Rules" - Tester

Save. Then click on edit again. Nothing will show up in the subject box. Looking at the HTML code you will find value=""WWF Rules" - Tester".

You need to use Server.HTMLEncode or some other trick to convert your quotation marks.

Otherwise, I just upgraded from RC1 to the current release. Nice job.


Edited by djlurchg - 12 May 2006 at 8:29pm]]> Wed, 10 May 2006 16:46:12 +0000 https://forums.webwiz.net/quotation-marks-not-replaced-when-upgrading_topic19796_post106692.html#106692