Htmleditformat & Database Field Lengths

I happened across an article about SQL injection, a topic I frequently look back into to see what new threats have been discovered, and this particular author was pushing for the use of htmleditformat on all form data being inserted into a database. Now I have coded and secured several different websites against SQL injection, each using simlar to slightly-varied techniques at blocking those pesky hackers, so my question is not how to prevent SQL injections, but instead my question is more about htmleditformat and database field lengths.
htmleditformat on user-inserted data is part of my SQL injection prevention scheme, but on rare occasion I have this problem:
Let's say I have a field in my database for the user's first name, with a generous length of 20 characters.
The user's name, just as an example, is 18 characters long. No problem, right?
But let's say that user's name has a symbol, or foreign language character, that then gets converted by htmleditformat behind the scenes? Suddenly that 18 characters balloons up to 23 characters, generating an error because my CFQUERYPARAM maxlength is 20, not to mention the field in the database.
So, for those who do scrub user data with htmleditformat, how do you handle this, if at all?

I agree with mack. HtmlEditFormat is intended for displaying strings, not making them safe. You might try using the StripHtml or SafeText user defined functions from cflib.org to remove undesired HTML from your input.
http://www.cflib.org/udf/stripHTML
http://www.cflib.org/udf/SafeText

Similar Messages

Increase of Field length. & vendor data @ sales documents

Dear all,
a. I want to increase the Sales employee - Remarks (field) length from 50 characters to 200 characters.
Can we increase the length of standard field's without using SDK? If yes, tell me how to do?
b. I am creating 2 UDF's @ marketing documents. - Title level
At first UDF - I want to see all the vendor master data (vendor codes) by formatted search
At the secound field - the address of the relevant Ship to r bill to address of vendor has to be filled down - as soon as i selected the vendorcode on the above field.
Can we map the UDF's as per the above requirement - with out using SDK & by using formatted search.
If - we can do with formatted search - help me of how to do & send me the query.
Thanks & Regards
ganesh

Ganesh,
The SAP database field lengths cannot be changed.
Reg the Formatted Search of Vendor Codes for the first UDF. The SQL would be like
SELECT T0.CARDCODE FROM [DBO\].[OCRD\] T0 WHERE T0.CARDTYPE = 'S'
YES, it is possible to trigger the FMS on the second UDF when the Vendor Code is filled in the firt UDF.
I am not clear with what you mean by the following
At the secound field - the address of the relevant Ship to r bill to address of vendor has to be filled down - as soon as i selected the vendorcode on the above field.
The Address information is in CRD1 table and you can use the first UDF's values in the WHERE clause of the SELECT statement in your second FMS
example:
SELECT T0.STREET, T0.CITY, .... FROM [DBO\].[CRD1\] T0 WHERE T0.CARDCODE = $\[ORDR.U_USERFIELD] AND T0.ADRESTYPE = 'B'
CHANGE U_USERFIELD1 with the name of your Vendor Code UDF
T0.ADRESTYPE = 'B' ..........FOR BILLING ADDRESS
T0.ADRESTYPE = 'S' ..........FOR SHIPPING ADDRESS
Suda

Re: [iPlanet-JATO] Finding the database column length

This is the technique I would recommend. If you'd like to wrap this
mechanism up in the model class itself, create a subclass of QueryModelBase
that provides such a method and use that as the base class for all your
QueryModels.
Todd
----- Original Message -----
From: "Craig V. Conover" <craig.conover@S...>
Sent: Friday, October 19, 2001 12:15 PM
Subject: Re: [iPlanet-JATO] Finding the database column length
Chidu,
The result set that you get back is a JDBC ResultSet, not a "JATO" resultset. In ND, everything was wrapped in a "spider" data
structure, and therefore, difficult to get to the underlying datastructure, in many cases. In some case ND made it easier to do
certain things, and in other ways, made it more difficult or impossible(like seeing the SQL for an insert, update, delete).
>
Anyway, looking at the java.sql package, you can do this.
java.sql.ResultSet rs = <jata-model>.getResultSet();
java.sql.ResultSetMetaData rsMeta = rs.getMetaData();
// not sure if this is what you need, but it was the closest thing I couldfind
int colSize = rsMeta.getColumnDisplaySize(int column);
There are numerous other methods in the ResultSetMetaData interface thatmay be of use as well.
>
c
chidusv@y... wrote:
Hi,
How do I find out the length of a database column in a data model? In
NetDynamics, we can do dataobject.getDataField(<field
name>).getColumnLength(). Is it possible to achieve this in JATO
without using a resultset?
Thanks,
Chidu.
For more information about JATO, please visit
http://developer.iplanet.com/tech/appserver/framework/index.jsp
>>
>>
>>
>>
>
>
>
For more information about JATO, please visit
http://developer.iplanet.com/tech/appserver/framework/index.jsp
>
>
>
>
>
>
>

This is the technique I would recommend. If you'd like to wrap this
mechanism up in the model class itself, create a subclass of QueryModelBase
that provides such a method and use that as the base class for all your
QueryModels.
Todd
----- Original Message -----
From: "Craig V. Conover" <craig.conover@S...>
Sent: Friday, October 19, 2001 12:15 PM
Subject: Re: [iPlanet-JATO] Finding the database column length
Chidu,
The result set that you get back is a JDBC ResultSet, not a "JATO" resultset. In ND, everything was wrapped in a "spider" data
structure, and therefore, difficult to get to the underlying datastructure, in many cases. In some case ND made it easier to do
certain things, and in other ways, made it more difficult or impossible(like seeing the SQL for an insert, update, delete).
>
Anyway, looking at the java.sql package, you can do this.
java.sql.ResultSet rs = <jata-model>.getResultSet();
java.sql.ResultSetMetaData rsMeta = rs.getMetaData();
// not sure if this is what you need, but it was the closest thing I couldfind
int colSize = rsMeta.getColumnDisplaySize(int column);
There are numerous other methods in the ResultSetMetaData interface thatmay be of use as well.
>
c
chidusv@y... wrote:
Hi,
How do I find out the length of a database column in a data model? In
NetDynamics, we can do dataobject.getDataField(<field
name>).getColumnLength(). Is it possible to achieve this in JATO
without using a resultset?
Thanks,
Chidu.
For more information about JATO, please visit
http://developer.iplanet.com/tech/appserver/framework/index.jsp
>>
>>
>>
>>
>
>
>
For more information about JATO, please visit
http://developer.iplanet.com/tech/appserver/framework/index.jsp
>
>
>
>
>
>
>

How to get 10 characters if there are 18 characters in database field

IF there are four fields in a internal table and each field have 18 character length. i should less the filed length of only 3 fields to 10 characters and should get this fields in Application layer and flat file ( out bound interface),
so can u guide me the logic how to populate the data in application layer and flat file with new field length of 3 fields and old field length of fourth field.

Hi Azeez,
First declare your internal by referring database fields and fetch data from data base into this internal table.
Ex:
types: begin of stru,
                             f1 type <t1>-f1,
                             f2 type <t1>-f2,
                             f2 type <t1>-f2,
                             f2 type <t1>-f2,
                          end of stru.
Lets consider all the above fields have length 18 in database.
data: itab type standard table of stru.
data: wa_itab type stru.
data: lv_char(48) type c.
select f1 f2 f3 f4 from t1 into table itab.
loop at itab into wa_itab.
concatenate wa_itab-f1+0(10) wa_itab-f2+0(10) wa_itab-f3+0(10) wa_itab-f4
              into lv_char.
<b>now transfer this variable (lv_char) to application server.</b>
endloop.
hope this helps.
Regards,
Phani.

DB Connect - different from length in database between length in DDIC

Hi Gurus,
We use BI 7.0 SP18.
We build DB Connect to other Oracle database.
I'd like to see the database tables in RSA1/SourceSystems/DB Connect/Current connection. In Additional Functions/Select Database tables (3.x)
After the table selection Edit DataSource and I can see the field structure of the table. My problem is the following:
The Length in Database different from Length in DDIC. Why? How can I solve this problem?
The different is the following:
field1:
Type: Char
Length in Database: 200
Length is DDIC: 67
field2:
Type: Char
Length in Database: 100
Length is DDIC: 33
field3:
Type: INT4
Length in Database: 22
Length is DDIC: 4
etc.
Thanks for your helps!

It can be character code table problem? For example, the source system store data in non-unicode format, but the BI 7.0. store data in unicode format? How can I try to check or fix it?

Forms not updating field lengths

All,
I've been changing field lengths in forms all day in OIM 9.1, and it never updates the actual column lengths when the form is activated. I've reverted to directly updating the column sizes in the database to get things working. Am I missing something here, or are field length changes in OIM completely useless?
S

We faced recently a similiar problem, but regarding export/import operations.
We changed the forms in our dev environment, and sizes updated correctly in the database. But when exporting and importing the forms into the QA environment, although field size in the form definition was updated, the field size in the database table didn't.
The workaround we found was to manually change field sizes in the form definition.
Hope this help!

Increasing field length on screen

Hi
I am new to OAF and need some help. We are using R12 and on one of OAF screen I need to make one of the field bigger on the screen. On database the field length is fine, but on screen the field is not big enough and users have to scroll to see the entire value. I need to make this field bigger so that users can see the entire data.
Please suggest.
Thanks

Hi,
If you have look at the VOimpl.xml file you can see the display size of the attribute which you want to increase the length.
If the display is smaller than the databae column, you can chage the .xml file and upload it again and once you bounce the apache server should do the trick.
Otherwise you have do all the process of extensions. as there is no other way you can increase front end.
-knick

Field length truncation ?

Hi Guys,
I have the xml data coming from SAP and it has the accounting document no field with 12 char long, but when i send this information to a 3rd party system and in the reponse i have the accounting doc number just with 10 char long. The database schema on the 3rd party system is designed for just 10 char.
The requirement is need to send this accounting document number back to SAP with the same 12 char as it has supplied.
any help would be appreciated
Thanks,
srini

HI,
While sending the filed from SAP to Third party system you need to reduce the field length to 10.
So Source filed --> Substring (Starting index, length (10)) -
>Target field.
Here you could truncate the intial 2 chars or last 2 chars of the filed.
You could have one suggestion to split the field in two different fileds while sending to target field.
Similarly for Target field ---> Source field
You need add suffix or prefix of 2 Chars may be 00 or any special chars.
IF you are spliting the filed in two seperate fields on Third party side then in reverse direction for sending it to SAP you could concatenate these two fields.
Thanks
Swarup

EKES-XBLNR Field Length

In ECC 6.0, the "reference" field on the Confirmation tab of the PO is only 35 characters long. Is there anything out there that will increase the field length to 70?

The domain XBLNR_LONG attach to the field EKES-XBLNR is of
35 Character String.
In standard system it is not possible to customize the field
EKES-XBLNR length to more than 35 character. Because field length is defined   at domian level which effects at system level i.e all applications   ,trasations etc.If you want to change the field
EKES-XBLNR lenegth to more than 35 char then you need to change this at database level i.e    domain level in tcode SE11
Please note that if you change at domain level then will effect to all other applications also.

String Fields Length

Hi,
Length of string fields in my crystal report are locked to 20 by default, but my data source's query's field length is 50. How can I fix the crystal report to show all 50 characters in the report?
Thanks and regards,
Al

Hi Hitesh and Crystalier,
Thanks for your replies.
I check marked "Can Grow" option and it didn't work.
Database is SQL Server 2005 and my connection is OLE DB (ADO). The database field is VARCHAR(50).
I noticed, under the Field Explorer --> Database Fields, the type of the field is showing as "String [20]". But the field in the datasource (SQL Server 2005) is Varchar(50). Also, when I right-clicked Browse Data on the field on Field Explorer, the data that was returned are all trimmed to 20 characters.
Thanks and regards,
Al

Risks of changing the field length of data structure of a Cluster Table

Hello,
We are on ECC 604 and had implemented HR & Travel Management. Reporting on these applications is done in BI. We use ESS and & Mobile Travel for time, travel expenses, etc and use PCLn clusters.
There is business need to change the length of a field from 20 to 40 for the data structure PTK** of cluster table PCL1.
We are exploring various options to avoid core modifications.
We are also assessing the risks associated with changing the field length.
I am asking you for your opinion about the risks associated with changing the field length of a data structure of cluster table.
Thanks & Regards,
Manoj K Pingali

Recently, we came across the same situation where we had to change the length of a field. Let me explain you what precautions we had taken during that time.
1. Apply the where use list of that table/ Field and check whether it has been used in some program and FM or not. If yes then check one more thing that check the TYPE of another variables on which system has populating data (move, write or in FM parameters). if you will not consider this then you can land you in big trouble. (Conversion dump)
2. Ask the basis to take a dump of the production, quality and data for the safer side if something does not go right.
Now, you can do the changes in your development system and then adjust the database and see the impact of it.
Hopefully, you will not come across any difficult situation in this changes.
Thanks.
Anurag

While generating a crystal report can we edit database fiels in field explorer (at middle can we edit database fields)

while generating a crystal report can we edit database fiels in field explorer (at middle can we edit database fields)

Wrong forum to post the question, try to post the question in crystal reports community.
Its not possible to edit the database fields while creating the reports, its only used to call the rows of values in it. Can you explain me in detail what are you actually looking for .
--SumanT

Store values of different data types into single database field

Hi Friends,
I have to store values of different data types(character, numeric, date, time, text, etc) into a single database field(Char 80). Then read the same values and display it into ABAP Webdynpro report.
Appreciate any ideas, examples, suggestions.
Thanks
JB

Hi,
Try like this:
data: txt1 type string,
      var1(1) type c,
      var2(1) type n,
      var3 like sy-datum,
      var4 like sy-uzeit.
parameters: a type c,
            b type n,
            c like sy-datum,
            d like sy-uzeit.
concatenate a b c d into txt1.
write txt1.
var1 = txt1+0(1).
var2 = txt1+1(1).
var3 = txt1+2(8).
var4 = txt1+8(8).
write: / var1,
       / var2,
       / var3,
       / var4.
Regards,
Bhaskar

Database fields empty after creating a new (Crystal) Report in MSY

Hello,
I have some issues to use Crystal Reports in Mobile Sales Maintenance (MSY). The situation is as follows
My example is based on this standard report, which is working
Report Name: BPartnerActivities
Reporting Tool: Crystal Reports
Category: Standard reports
Subcategory: Lists
Report Type: Report
Data Source: Business Content provider
Business Content Provider: BPActivities
My requirement is to build a new report, which is based on the standard "BPartnerActivities" Report. If I use the "copy" functionality, I get an working Copy of the standard report. However, I need to modify the Business Content Provider, but I do not want to make the modifications on the standard content provider "BPActivities".
I am now forced to used the "copy" functionality to create a copy from "BPActivities" for my own Content Provider "My BPActivities copy", which I want to use in a new report.
Issue:
I cannot modify the defined Business Content Provider after using the "copy" functionality and hence forced to create a new report from scratch to be able to set a different Content Provider.
I create my own report "MyBPartnerActivities" based on the standard report "BPartnerActivities" using the same settings and assign my new business content provider.
If I use the "Design Report" or "Modify Report" button, the Crystal Report designer pops up. Now the problem, the Crystal Report designer does not offer me any data below "Database fields".
In the standard report, the "Database fields" has a child element "BOACTIVITY-ttx" with several field options. My own created report from sratch does now have anything?!
Why my report does not offer my any data or is there anything additional to do?
Another Test
I tried to create another report using the standard content provider "BPActivities", but I have still the same issue.
In addition I recongized that the "browse data" fuctionality does not work on the fields in the standard report. The path to the database file does not exist. It starts with "C:\WINNT\...", but my system has "C:\WINDOWS\...". But the executed report is able to retriev the data?!
Unfortunately was not able to find any proper documentation, but I would really appreciate any help.
Regards,
Andreas

Update
It looks like that the *.ttx file is not uploaded/create to/on the MSY system. The system shows the file in the Crystal Report Designer, but there is no file on the file system. The confusing thing is, that any standard report is still working and does not really complain about a missing ttx file. I think the content of the ttx file is somehow embeded to the report.
Does someone know how the system should behave? Should a ttx file be automatically created & assigned to any new report or do I have to create the file by my own every time?
Cheers,
Andreas

Field length change in Web Dynpro Components iView

Hi,
We are using SAP MDM Web Dynpro Components - Configuration Manager (NW7.3) to develop the UI. One of the issue while disply field is, Though field maintained in MDM has only 2 charaters UI that displays a full-screen-width field.
I would like to display actual field length maintained in reposiroy for each field. Is it possible??
Cheers,
Rc

This is closed.
By mistake Raised Twice....I guess I need break

Htmleditformat & Database Field Lengths

Similar Messages

Maybe you are looking for