jQuery, javascript array / object SQL enjeksiyon sorunu

0 Cevap php

Ive got a problem and i don't have any idea how to fix it. Ive a module on my site that shows some data, it uses jquery dom and it creates some elements from a javascript array, witch contains javascript objects. This array is generated with php and it gets the data from a postgres database.

So if a user tries to inject the database the database stores the string as a normal entry, i have no problems with it. The problem appears when I want to list the content. But, only on client side. The listing is done, ive generated the string, i pass it to client side, the dom elements are created, but they have no content. Im using the php function addslashes() to escape the escapes, but i only get in trouble.

Yani: burada dizidir

[
    {"id": "26", "text": "RSS Feed collection"},
    {"id": "50", "text": "\\ \' "}
]

Gördüğünüz gibi, son bir deney enjeksiyon içeriyor

edit
HTML code:

 <div class="item">
     <span>Text</span>
 </div>

Bu jQuery kullanılarak oluşturulur.

JS bölüm:

var myArray = [the upper array];
var container = $("#container");

for( nI=0, nC = myArray.length; nI<nC; nI++) {
    var currentObj = myArray[nI];
    var newItem = $("<div />").appendTo(container);
    $("<span />").appendTo(item).html(currentObj.text);
}

Ve sonuç dizisi gayet iyi görünüyor, görülebilir bir şey değildir, ama metin olmalıdır normalde her yer boş. Neden soru?

0 Cevap