How am i supposed to prevent sm from pasting code in my JSP page?

Hello,
as i was testing my JSP page i noticed that when sm places code in an input box , it seems that the page is affected by that.
Well i have a very simple form like:
<form style="text-align:left" method="POST" name="edit" action="Edit" >
<input type="text" name="year" size="5" maxlength ="50" value="<%= convertdate.ReturnYear((resultset.getString(19)) %>">
<input type="submit" name="Submit" value="Store Data" >
</form>i noticed that when i was placing code in the button year of the form like:
out.println("<HTML><HEAD><TITLE> " + "Error in PAGE BLAH BLAH BLAH" + " </TITLE></HEAD><BODY>");my website was affected by that and some pages looked different and couldn't display data from the database, although the data existed in the db.
What am i supposed to do? How am i supposed to prevent a user from inserting code in inputs of a form?
Also, sometimes when i was pasting code, some SQL exceptions appeared saying : Data too long for field etc.
The weird was that the data was in the limit. I'm very worried about this problem because the sql exceptions show the names of my tables and i think
that this is dangerous for malicious attacks in the website.
Thanks, in advance!
Edited by: g_p_java on Sep 5, 2009 5:09 PM
Edited by: g_p_java on Sep 5, 2009 5:14 PM
Edited by: g_p_java on Sep 5, 2009 5:15 PM

smogura.eu wrote:
All notices are important & how to say... you can place Java code in JSP, but in commercial job you will need to find new job.
Well i'm not actually working somewhere, i'm student and i have to make this project.
It's the first time I use JSP, servlets etc, so that's why i find a difficulty in using them.
Why your pages are messed? If you put HTML code in db, rendered page is like
..="50" value="<HTML><HEAD...{code}
this will prevent browser to render page properly. Well i was actually pasting some data in order to check if the data is too long for the field and afterwards the page changed and many fields disappeared...
There are two ways to prevent inserting code, in your JSP, and you need use it, as no separating view logic, data acquisition from page will not prevent this error
1. You need disallow user entering ", <, ' etc...., best way by validating input on server side, by this will prevent user from entering all texts, or
2. You need replace all HTML special char with their HTML codes when rendering, the simplest way
convertdate.ReturnYear((resultset.getString(19)).replace("\"", "&#34'").replace(...).replace(...)
{code}
You must use this in back logic.May you please elaborate on that, you mention that i shall replace the year with "&#34'",
What is that "&#34'"?
and why do you use 3 "replaces"?
About prepared statements.
Preparation will not only prevent you from SQL injections, but can speed up application, if your driver uses statement caching.
Why after creating prepared statement, you then create normal statement, in your example code?I hadn't noticed that, thanks.I 'll change them. But Statement is less secure than PrepareStatement?
Thanks, in advance!

Similar Messages

How do I Display a string from a servlet into a JSP Page???? NEED HELP!!!!

Hi guys,
How do I Display a string from a servlet into a JSP Page...
Ive tried so many bloody things!.....
Simply.
I get text from JSP. The servlet does what ever it does to the string.
Now. Ive create sessions and bean things,.... how the hell do I display it in a text box... I can display on the screen.. but not in the text box.!!!
please help!!!

hmmm, I dont really like using JSP programming, u should be using JAVA..
the way to do it is:
Call and cast to the bean like this:
<%@ page import="beans.*" %>
<% //cast to bean get request create object
userNameBean u= (userNameBean) request.getSession().getAttribute("userNameBean");
then... all you do is call it like this:
<input type="text" name="firstName" value="<%= u != null? u.getFirstName(): "" %>">
this is the real programmers way,,,
chet.~

How to execute a Command Prompt command from J2SE code executing on Windows

How to execute a Command Prompt command from J2SE code executing on Windows??
Please help me

[http://java.sun.com/docs/books/tutorial/getStarted/]
~

How to send SMS ( Short Message Service ) from java code

Hi
How to send SMS ( Short Message Service ) from java code.
Thanks
Gaurav

Do you need to receive SMS? If you need to receive SMS, you will need to host your own GSM device or modem so that people can send you SMS.
If not, you can just use internet SMS gateways like clickatell as mentioned above will do the work, and post to them by HTTP, XML or email. The cost is about 6-8 cents per SMS. There are cheaper services, but not always reliable. If you need to host your own GSM device, you can use software like http://www.kannel.org (GPL Open Source) or http://www.visualgsm.com. Alternatively, you may obtain a shortcode from your Telco - but these come with monthly subscription of maybe one or two hundreds.
Regards,
Joshua
<SMS Gateway>@Expert

Retrieve values from a table of a JSP page in Servlet.

Hello all,
I am new in JSP servlet world, I want to create a grid on JSP page using Servlet.
Suppose i have some records in a JSP page and This JSP page will display these records in a tabular form. And, on a button click that table data should be
accessible in servlet,
Now, How can i traverse among all the rows of that table of JSP page in servlet. or How can i retrieve a specific cell record of that table of JSP page in servlet.
Can anyone please answer this.
Thank you and regards.

Hi,
Create in your HTML form inputs with the same name i.e.:
<input name="a[]" value="2" >
<input name="a[]" value="9" >
In your jsp page use :
String Values[] = request.getParameterValues("a[]") ;
This will give you a string array of two elements.
for (int x = 0; x < Values.length; x++)
System.out.println(Values[x]) ;
}Will print :
2
9
Hope this helps.
Bill Moo

How i can make my own connection in java source of a jsp page

How i can make my own connection in java source of a jsp page (How to get connection from JNDI datasource address) ?
imagine that i have a rowset in a web page , now i want to do some operation using
plain JDBC , so i will need a connection object.
I tried to get one of my rowsets connection but it return null ?
what is best way to retrive a connection from JNDI datasource that we define for our project?
for example if i have
myRowSet.setDataSourceName("java:comp/env/jdbc/be");
in web page constructor
now i want a pure connection from the same datasource ? JNDI
Thank you

It is not hard to get your own connection from datasource.
in your case you need to do like the the following code.
i provide sample to show you how to catch the exception and create an statement .
Connection con =null;
try{
InitialContext ctx = new InitialContext();
DataSource ds = (DataSource)ctx.lookup("java:comp/env/jdbc/be");
con = ds.getConnection();
java.sql.Statement st =con.createStatement();
}catch(SQLException sqlex){
sqlex.printStackTrace();
sqlex.getNextException().printStackTrace();
catch(NamingException nex){
nex.printStackTrace();
hth
Masoud kalali

Passing input parameters from an applet to a JSP page

Hello all,
Yes, its one of these questions which I have tried to find a solution from the already large number of postings but with no luck. I'm still a novice to Java/JSP so bear with me.
Consider this scenario.
1. An applet which has two input boxes (say First name and surname). 2. These parameters will be passed to a JSP page (so the applet will call a JSP page).
3. The JSP will have have the necessary logic (or actually a JavaBean will) to connect to a database and add a new record with these parameters (first name and surname).
I also need to consider editing/updating the record in the database. So a JSP page will connect to the database, retrieving the required record from the database and then display the parameters back in an applet in two input boxes (first name and surname) to be edited and saved again.
I have been able to develop a similar application using simple HTML forms to add and update records in a database so I'm not worried about the database connectivity simply the issue of passing parameters from the applet to the JSP page and vice versa (for edit/update).
Once i've managed to do this with input boxes, I can experiment with the other input types radios, checkboxes, select etc.
Many thanks in advance,
Assad

create an URL object with u'r specified link of the java class and send the parameters..write trhis action in any buttonclick event in u'r applet.

How to modify an existing xml file from java code.

Hi
I have worked on creating a new xml file from java code using xmlbeans.But if i try to modify an already existing file using java code I am unable to get errorfree xmlfile.
For example if xml file(studlist.xml) is as below:
<?xml version="1.0" encoding="UTF-8"?>
<StudentList xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="D:\kchaitanya\xmlprac1\abc\Studlist.xsd">
     <Student>
          <Name>ram</Name>
          <Age>27</Age>
     </Student>
<Student>
          <Name>sham</Name>
          <Age>26</Age>
     </Student>
</StudentList>
Now suppose i have set name to victor using student.setName,
and set age to 20 using setAge from javacode,
the new xml file is as follows:
<?xml version="1.0" encoding="UTF-8"?>
<StudentList xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="D:\kchaitanya\xmlprac1\abc\Studlist.xsd">
     <Student>
          <Name>ram</Name>
          <Age>27</Age>
     </Student>
<Student>
          <Name>sham</Name>
          <Age>26</Age>
     </Student>
</StudentList>
<Student>
          <Name>victor</Name>
          <Age>20</Age>
     </Student>
As observed this is not a valid xml file.But how can i modify without any errors?

I know it's an old post, but I found this while doing a google search for something else, and don't like to leave it un-aswered
Just in case anyone has a similar problem... In this case the new elements have been appended outside of the root element
What you need to do is first get the root element and then append the new children to that, there are several ways of getting the root element, which depend on what you want to do with the elements you get back here's a simple (incomplete) way.
// gets the root element of the specified file (code not shown)
Element rootElement= new SAXReader().read(file).getRootElement();Then just append the new elements as below (this is non-generic code and would need to be modified for your situation)
// write a new student element
Element student = document.createElement("Student"); // creates the new student
rootElement.appendChild(student); // ***appends it to the root element***
Element name = document.createElement("Name"); // creates the name element
name.appendChild(document.createTextNode("Fred")); // adds the name text to the name element
student.appendChild(name); // appends the name to the student
Element age= document.createElement("Age"); // creates the age element
age.appendChild(document.createTextNode("26")); // adds the age text to the age element
student.appendChild(age); // appends the name to the studentThen flush ya buffers or whatever and write the file
Edited by: Dream-Scourge on Apr 23, 2008 11:10 AM

How to access an object's variable from native code

i am passing an object in a native method.i have to change the value of the object's variable.how do i access the variable of object and assign it new value from c++ code.when i try to access it i get a message that the variable must have a class/sruct/union type.
pl. help.

I'll tell You if You send me the structure of this object in Java. And a name of field what are You thinking about.
Maciek

How to view UNused report or programs from past 1year

Hi All,
I have a query, I want to see which are the programs and reports are not used from past 1year, i want to extract those programs or reports.
Can any one help me in this.
thanks,
Praveen Kumar B.V

Hi Praveen,
I'm not sure that this can be done, at least i don't know of any application within SAP that will return with the results you're looking for... and even then I don't think is a good idea to remove standard programs or reports from SAP and i cant see how will this help you achieve anything.
You can always check the program version with version management to see if the program been modified lately but that's as far as i can go.
Regards
Juan

How to display contents from a database to a jsp page

hi im using hibernate , i want to display the conetents from a databse to jsp page which is having a form
i want to get the data on the form fields after changing the values i want to write it back to the database
im using struts and hibernate
im struck with this plz help me

j2ee_struts_hibernate wrote:
hi im using hibernate , You probably shouldn't be using Hibernate.
i want to display the conetents from a databse to jsp page which is having a form "contents", "database"
i want to get the data on the form fields after changing the values i want to write it back to the databaseWhat don't you understand? (Sounds like you don't understand anything.)
im using struts and hibernate How well do you know Struts? Hibernate? JSP? Java?
im struck with this plz help meAsk a specific question and we'll see what we can do.
Write a JSP with the form in it; submit to Struts; Struts interacts with the database. That's the flow.
%

How to get the value retruned by java script function into my jsp page

Hai all,
I had a particular java script function which returns a date.
function getDate() {
var sDate;
// This code executes when the user clicks on a day in the calendar.
if ("TD" == event.srcElement.tagName)
// Test whether day is valid.
if ("" != event.srcElement.innerText)
//alert(event.srcElement.innerText);
sDate = document.all.year.value + "-" + document.all.month.value + "-" + event.srcElement.innerText;
document.all.ret.value = sDate;
var mahi=window.open("configurexml.jsp?xyz=document.all.ret.value")
return sDate;}
Now i want to display this particular date in my jsp page. can anyone tell me the correct approach or a sample code to diaplay this date in my jsp page.
<%@ page language="java"
import="javax.xml.parsers.*,java.io.*,org.w3c.dom.*"%><%@ page import="java.util.*" %>
!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <head> <title>Configuring Xml File</title>
<SCRIPT LANGUAGE="JavaScript" SRC="xyz.js"> </SCRIPT>
body bgcolor="#d0d0d0" onClick= "return getDate()" >
<form name="f1">
<b>20 october 2006 </b>
Here where i am printing the date i had to get the value from the js function. how to do that. plz help me....

Are you talking about server-side java code (servlets/jsp) or client side (applet)? Given we are in the JSP forum I'll assume we're talking server side.
If so, you are making a common but fundamental mistake. JavaScript executes on the client, not on the server. If you want client data on the server it has to get there somehow. The simplest way to do this in JSP land is via HTTP. So... have your JavaScript code call a JSP (or servlet) and pass the value you want as a URL parameter. Of course this will also change the browser location, so if you don't want this to happen use a frame or iframe to capture your HTTP request.
For example:
Javascript....
function someFunction() {
return 1;
var value = someFunction();
location.href="somejsp.jsp?value=" + value;

Display multiple Images from a DB on a JSP Page!

Hi all, please give me your solution, thanks. I have many images, stored in Oracle database (BLOB), How to display all of them (images) on a JSP page? I have a working solution that only shows one image based on the specific image-name passed. But if no image found in the Database with that image-name then I want to show all the images at once on a JSP page. Can someone help please. Follwing are the code snippets:
Here is the JSP page that calls the servlet to show the images:
<%@ page contentType="text/html;charset=windows-1252"%>
<html>
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
    <title>untitled</title>
</head>
<body valign=center>
      <table>
        <tr>
            <td>
                <img src="/test-testimgs-context-root/servlet/test1.images.servlet.GetImage">
            </td>
        </tr>
      </table>
</body>
</html>
Here is the code that resides in the service method of GetImage servlet:
public void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
    OutputStream stream = response.getOutputStream();
    Blob imgBlob = null;
    ResultSet rs = null;
    byte[] imbBytesAry = null;
    try
        ImageTest imgtest = new ImageTest();
        rs = imgtest.get("img1.tif");
        if(rs != null)
            while(rs.next())
                imgBlob = rs.getBlob(1);
                int len = new Integer( new Long( imgBlob.length()).toString() ).intValue();
                imbBytesAry = imgBlob.getBytes(1,len);
                if (imbBytesAry.length == 0 || imbBytesAry == null)
                    noImageFound(request, response);
                else
                    stream.write(imbBytesAry);
        else
            noImageFound(request, response);
    catch (Exception e)
        noImageFound(request, response);
Here is the code that resides in the get method of ImageTest class:
public ResultSet get(String fileName) throws DatabaseConnectionException, SQLException, Exception
Connection connection=null;
ResultSet rs = null;
ResultSet rs1 = null;
Blob imgBlob = null;
try
    connection = new ConnectionProvider().getCConnection() ;
    connection.setAutoCommit(false);
    Statement stmt = connection.createStatement();
    String sql = "SELECT IMG FROM IMAGE_TABLE WHERE IMAGE_NAME = ? ";
    PreparedStatement pstmt = connection.prepareStatement(sql);
    pstmt.setString(1,fileName);
    rs = pstmt.executeQuery();
    boolean flag = rs.next();
    if(flag)
        rs.beforeFirst();
    else
        sql = "SELECT IMG FROM IMAGE_TABLE";
        rs1 = stmt.executeQuery(sql);
        boolean flag_all = rs1.next();
        if(flag_all)
            rs1.beforeFirst();
        else
            rs1 = null;
    return rs;
}As you see in the JSP page I am calling GetImage servlet, whose service method does all the processing i.e. calls ImageTest get method that queries the database and returns the result. Eventually what I would like is to pass the filename along with other parameters from JSP page and the servlet returns the images based on that. Currently I have just hard coded a value for testing puposes. Any help is appreciated.
Thanks

Hi all, please give me your solution, thanks. I have many images, stored in Oracle database (BLOB), How to display all of them (images) on a JSP page? I have a working solution that only shows one image based on the specific image-name passed. But if no image found in the Database with that image-name then I want to show all the images at once on a JSP page. Can someone help please.
this is the code
<form name="a" action="" method="post">
<%
rs1 = st1.executeQuery(select1);
rs1.next();
while(rs1.next())
%>
<table>
<tr><td>
<%
Blob objBlob[] = new Blob[rs1.getMetaData().getColumnCount()];
     for (int i = 0; i <= rs1.getMetaData().getColumnCount(); i++)
           objBlob[i] = ((OracleResultSet)rs1).getBLOB(1);
          InputStream is = objBlob.getBinaryStream();
byte[] bytearray = new byte[4096];
int size=0;
response.reset();
response.setContentType("image/jpeg");
response.addHeader("Content-Disposition","filename=getimage.jpeg");
while((size=is.read(bytearray))!= -1 )
response.getOutputStream().write(bytearray,0,size);
response.flushBuffer();
is.close();
out.println("hhhhhhh");
%>
</table>
<%
rs1.close();
//con.close();
%>
</form>

How do create a multi select that is one directional in a jsp page

i am trying to create a one directional multi select in jsp that is when select the option from the multi- select the first time is not appear again that is for instance if i have a status option of
NEW
Fix
Closed
they should come from the database from and if they have been selected once and save in another table they should not appear again... that is is you selec Fix you cannot go back to New... how can I accomplish that in jsp
my default is coming from on table and the rest from another reference table with for all the drop downs.

Thanks. I sorted it out after a while. The problem that I was having is that Pages seemed to treat the copied and pasted webpage content almost like an image: indivisible. I had to go back to the page and copy a few pages at a time. Then I could paste the content in one page after another.

Retrieving lists from other layer into a JSP page - Design Question

Hi all,
What should be a good design technique in order to allow a JSP page to present some list obtained from other layer of my application. I intend to leave only presentation logic in the JSP layer, while all data access will be in other layer.
For example, I have a JSP page that will show the results of a SQL query originated from an entry form in other JSP page. Let's name them 'search.jsp' and 'result.jsp'
I want that all JDBC access be done in some other layer.
Question 1:
What would be better for this task? A servlet or a bean? (A bean, I suppose?)
Then this bean (?) would have to find some way to pass all the result set into this 'result.jsp'. I think it would be very poor design if I used some Data Object, because it would have to store all rows and pass them at once.
I don't want, either, that the presentation (JSP) layer access directly the data access layer (JDBC, files...). This way, I don't want any JSP page accessing the Resultset object directly.
Question 2:
What do you think could be a good design technique?
I thought of some intermediate layer that provided data objects and data access interfaces. I mean, as my data will come from different sources, like some database (JDBC), some Electronic Document Manager, I thought of having a common access interface, that would provide methods for accessing the resultsets. This could be even a java.util.Enumeration that has a hasMoreElements() method that could be implemented as the next() method from JDBC result sets and the nextElement() method that would actually bring the next row of data.
This way the JSP layer would see only hasMoreElements() and nextElement() methods from the middle layer. On the other hand, the data layer would provide as many different implementations to this access interface (Enumeration?) as there were data sources (JDBC, Files, ...)
Question 3:
What do you think of this design?
Question 4:
Is there any flaw in my approach? Which?
Question 5:
Could you suggest other designs?
I really thank you all, for any kind of answer. I actually use this design for development, however I've never seriously discussed it with someone... this is going to be of great value for me.
Regards,
Filipe Fedalto

Well I saw you question and I'll tell you what I do.
I have JSP's which post form data to servlets.
The servlet then calls a factory to produce a ResultContainer (analagous to your lists) which is generated
via JDBC, and/or request parameters etc...
this provides a single point of reference and a "group" of containers (functions really) that can be produced and reused (same container different amount of data)
I also have other static classes which can manipulate the data in the containers
(such as add additional info to the items in the containers) before I forward the container (request attribute)
to the JSP page
Additionally I use Type safe constants for all my HTML form tag names (easier to change and ensure the same name is used everywhere when reading parameters) and again for item statuses
and any other info I need to send along with the page (using Javascript to update the
status to another type safe constant).
I've found that using factories for ResultContainers is very worthwhile and allows you to implement additional servlets extremely quickly (mostly reusing containers that exist) and since the
container is the same for all my JSPs (this may not be the case with you) I can implement JSP's
very quickly as well (just change the view)
btw I refrain from calling my ResultContainer a bean because it is not serializable
I don't know if this will help but at least it gives me a forum to test my ideas
Thanks

How am i supposed to prevent sm from pasting code in my JSP page?

Similar Messages

Maybe you are looking for