displaying data from mysql onto browser in correct format .. (usingtemplate toolkit )
displaying data from mysql onto browser in correct format .. (usingtemplate toolkit )
am 27.05.2011 12:48:21 von Agnello George
--20cf30050e0e2a9ca304a43fad46
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Hi
I am using TT to display my data from my db ,
i insert the following data from a Front end using (
Re: displaying data from mysql onto browser in correct format .. (using template toolkit )
am 27.05.2011 14:35:13 von Shlomi Fish
On Friday 27 May 2011 13:48:21 Agnello George wrote:
> Hi
>
> I am using TT to display my data from my db ,
>
>
> i insert the following data from a Front end using (
Re: displaying data from mysql onto browser in correct format ..(using template toolkit )
am 27.05.2011 14:51:21 von Agnello George
--000e0cd56a5402cd1a04a44165d1
Content-Type: text/plain; charset=ISO-8859-1
On Fri, May 27, 2011 at 6:05 PM, Shlomi Fish wrote:
> On Friday 27 May 2011 13:48:21 Agnello George wrote:
> > Hi
> >
> > I am using TT to display my data from my db ,
> >
> >
> > i insert the following data from a Front end using (
Re: displaying data from mysql onto browser in correct format .. (using template toolkit )
am 28.05.2011 09:44:38 von Shlomi Fish
On Friday 27 May 2011 15:51:21 Agnello George wrote:
> On Fri, May 27, 2011 at 6:05 PM, Shlomi Fish wrote:
> > On Friday 27 May 2011 13:48:21 Agnello George wrote:
> > > Hi
> > >
> > >
> > > is there a way i can display on my browser with a new-line or
> >
> > First of all, make sure you avoid HTML-injection/cross-site-scripting
> > (XSS) attacks:
> >
> > http://community.livejournal.com/shlomif_tech/35301.html
> >
> > Then you can use something like:
> > $s =~ s{\n}{
}g;
> awesome!! it works
>
> i had to do some thing like this !!
>
> my $select_dom0_data = $DBH->selectall_hashref("select
> dom0_name,cpu,lvm,ram,ip,application,assigned_to from dom0_info where
> dom0_name='$dom0_server' and rid=$rack_n",'dom0_name' );
>
This interpolation of string variables into an SQL statement is an SQL
injection attack waiting to happen:
* http://en.wikipedia.org/wiki/SQL_injection
* http://community.livejournal.com/shlomif_tech/35301.html
* http://bobby-tables.com/
Please avoid it by using placeholders.
> $select_dom0_data->{$dom0_server}{lvm} =~ s{\n}{
}g; ;
You probably should assign that to a temporary variable.
Regards,
Shlomi Fish
--
------------------------------------------------------------ -----
Shlomi Fish http://www.shlomifish.org/
Best Introductory Programming Language - http://shlom.in/intro-lang
My Commodore 64 is suffering from slowness and insufficiency of memory, and
its
display device is grievously short of pixels. Can anybody help? -- Omer Zak
Please reply to list if it's a mailing list post - http://shlom.in/reply .
--
To unsubscribe, e-mail: beginners-unsubscribe@perl.org
For additional commands, e-mail: beginners-help@perl.org
http://learn.perl.org/
Re: displaying data from mysql onto browser in correct format ..(using template toolkit )
am 28.05.2011 10:54:12 von Agnello George
--20cf303f6d58c2a09704a45232fe
Content-Type: text/plain; charset=ISO-8859-1
On Fri, May 27, 2011 at 6:21 PM, Agnello George wrote:
>
>
> On Fri, May 27, 2011 at 6:05 PM, Shlomi Fish wrote:
>
>> On Friday 27 May 2011 13:48:21 Agnello George wrote:
>> > Hi
>> >
>> > I am using TT to display my data from my db ,
>> >
>> >
>> > i insert the following data from a Front end using (
Re: displaying data from mysql onto browser in correct format ..(using template toolkit )
am 28.05.2011 12:48:59 von Agnello George
--000e0cd350f83e09e604a453cd15
Content-Type: text/plain; charset=ISO-8859-1
On Sat, May 28, 2011 at 2:24 PM, Agnello George wrote:
>
>
> On Fri, May 27, 2011 at 6:21 PM, Agnello George wrote:
>
>>
>>
>> On Fri, May 27, 2011 at 6:05 PM, Shlomi Fish wrote:
>>
>>> On Friday 27 May 2011 13:48:21 Agnello George wrote:
>>> > Hi
>>> >
>>> > I am using TT to display my data from my db ,
>>> >
>>> >
>>> > i insert the following data from a Front end using (
Re: displaying data from mysql onto browser in correct format .. (using template toolkit )
am 28.05.2011 13:07:07 von Octavian Rasnita
From: "Agnello George"
> great !! i used tinymce in my insert form that solved all my html =
alignment
> problem :)
It would be much great if you wouldn't quote more than 140 lines of =
previous messages just to answer a single line... :-)
Octavian
--
To unsubscribe, e-mail: beginners-unsubscribe@perl.org
For additional commands, e-mail: beginners-help@perl.org
http://learn.perl.org/
Re: displaying data from mysql onto browser in correct format ..(using template toolkit )
am 29.05.2011 20:01:26 von Agnello George
--001517592fa0a3cab304a46df56b
Content-Type: text/plain; charset=ISO-8859-1
>
> This interpolation of string variables into an SQL statement is an SQL
> injection attack waiting to happen:
>
> * http://en.wikipedia.org/wiki/SQL_injection
>
> * http://community.livejournal.com/shlomif_tech/35301.html
>
> * http://bobby-tables.com/
>
> Please avoid it by using placeholders.
>
how can i have place holder when i am trying to get a hashref ..
$select_hashref = $DBH->selectall_hashref(" select * from mytable where
username=$name ") ;
i can not use a the <>> place holder here can i .. ?/
> --
>
Regards
Agnello D'souza
--001517592fa0a3cab304a46df56b--
Re: displaying data from mysql onto browser in correct format .. (using template toolkit )
am 29.05.2011 20:34:21 von Octavian Rasnita
From: "Agnello George"
> >
>> This interpolation of string variables into an SQL statement is an =
SQL
>> injection attack waiting to happen:
>>
>> * http://en.wikipedia.org/wiki/SQL_injection
>>
>> * http://community.livejournal.com/shlomif_tech/35301.html
>>
>> * http://bobby-tables.com/
>>
>> Please avoid it by using placeholders.
>>
>=20
>=20
> how can i have place holder when i am trying to get a hashref ..
> $select_hashref =3D $DBH->selectall_hashref(" select * from mytable =
where
> username=3D$name ") ;
>=20
> i can not use a the <>> place holder here can i .. ?/
>=20
Hi,
From perldoc DBI about selectall_hashref:
"This utility method combines "prepare", "execute" and =
"fetchall_hashref"
into a single call. It returns a reference to a hash..."
Use prepare, execute and fetchall_hashref and you will be able to do the =
same thing and also use placeholders.
read:
perldoc DBI
Octavian
--
To unsubscribe, e-mail: beginners-unsubscribe@perl.org
For additional commands, e-mail: beginners-help@perl.org
http://learn.perl.org/