How to insert html code from editor into MySQL database?

Question

I have an html editor and I am trying to insert the html it generates into the database and then retrieve it in another page where is the SQL table. I am using a table with one text field with asp 3.5. Here is the code:

MySqlConnection con = new MySqlConnection(@"Connection String  ");//I've tested the connection string and its working fine

MySqlCommand cmd = new MySqlCommand("INSERT INTO ins (tes) VALUES ('" + Editor1.Content + "')", con);

con.Open();
cmd.ExecuteNonQuery();
con.Close();

This is the error I get:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'font-size: 18pt; line-height: 115%; font-family: "arial","sans-serif";'>Whatever' at line 1

How can this be done? Thanks in advance.

Could you be more precise and indicate what goes wrong exactly ?? — Bruno
– Bruno, Commented Apr 19, 2011 at 10:32

Anyname Donotcare · Accepted Answer · 2011-04-19 10:43:22Z

2

I think you should use parametrized query instead, and never trust user data entry.please what is the type of tes, and could you clarify what is the error or the exception?

edited Apr 19, 2011 at 10:43

answered Apr 19, 2011 at 10:33

Anyname Donotcare

11.5k72 gold badges233 silver badges409 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Wahtever Over a year ago

could you explain more please , and tes is a text

Anyname Donotcare Over a year ago

i mean parametrized query guarantee no sql injection , and no problems from the special characters. weblogs.asp.net/cumpsd/archive/2004/04/05/107456.aspx en.wikipedia.org/wiki/SQL_injection

Paulo Santos · Accepted Answer · 2011-04-19 10:35:45Z

0

And you open yourself to a lot of SQL injection. Data coming from user should alwyas be checked and sanitized before ending up in the database.

Besides, using ASP.NET you need to remove any HTML tags from the postback because the framework checks for possible HTML injection coming from the browser.

After removing the tags (or replacing the < by something like <) and converting back in the server, you can use something like:

MySqlCommand cmd = new MySqlCommand("INSERT INTO ins (tes) VALUES ('" + Editor1.Content.Replace("'", "''") + "')", con);
con.Open();
cmd.ExecuteNonQuery();
con.Close();

Although you should make parametrized queries.

answered Apr 19, 2011 at 10:35

Paulo Santos

11.7k5 gold badges45 silver badges67 bronze badges

Comments

Davidson Sousa · Accepted Answer · 2011-04-20 16:44:41Z

0

Something like this might work:

MySqlCommand cmd = new MySqlCommand("INSERT INTO ins (tes) VALUES (@text)", con);

cmd.Parameters.Add("@text", SqlDbType.Text);
cmd.Parameters["@text"].Value = txtTextField.Text;

con.Open();
cmd.ExecuteNonQuery();
con.Close();

edited Apr 20, 2011 at 16:44

answered Apr 19, 2011 at 10:42

Davidson Sousa

1,3532 gold badges15 silver badges34 bronze badges

1 Comment

Anyname Donotcare Over a year ago

yeah , you can use similar code (parametrized query) for mysql, just the syntax will be a little different, they use (?) instead of (@) to indicate that is a parameter.

Collectives™ on Stack Overflow

How to insert html code from editor into MySQL database?

3 Answers 3

2 Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related