So i'm sending a String with javascript to a php page :
if(cp.value!=''){
s+=cp.name +" LIKE '%"+ cp.value +"%'";
console.log(s);
if(sec.value!=''){
s+=" AND "+sec.name+" LIKE '%"+ sec.value +"%'";
console.log(s);
}
}
else{
if(sec.value!=''){disappear
s+=sec.name+" LIKE '%"+ sec.value +"%'";
}
}
console.log(s);
if(s.length!=0){
var connect = new XMLHttpRequest();
connect.onreadystatechange=function(){
if (connect.readyState==4 && connect.status==200){
var resu=connect.responseText;
console.log(resu);
var tab=document.getElementById("main_tab");
tab.innerHTML=resu;
}
};
connect.open("POST","../../Controller/stage.php",false);
connect.setRequestHeader('Content-Type','application/x-www-form-urlencoded');
connect.send("s="+s);
}
}
The string sent is for exemple :
CP_Stage LIKE '%90%' AND secteur_stage LIKE '%ait%'
But when i print the request in the php page i have something like :
SELECT * FROM Stage WHERE CP_Stage LIKE '�%' AND secteur_stage LIKE '%ait%';
i have no idea why my first number disappear with the first %.
If anyone have an idea it would be awesome, thanks !
The percent-sign is a special charcter. Any special characters like %,&,? etc need to be encoded. Your "%90" is converted to an Ascii-Value. You have to encode these values with encodeURIComponent.
s += cp.name + " LIKE '" + encodeURIComponent("%" + cp.value + "%") + "'";
Note that encodeURIComponent does not escape the ' character. If your cp.value has an ' you have to replace it with its encoding value: %27.
By the way.. its a bad idea to send mySQL-queries from client-side - thats a major security flaw. Send only the values and build your queries on server-side.
Related
Why whenever I run encodeURIComponent('my_url'), I get a weird looking URL like https%3A%2F%2Fr[...]... Why is that and how do I solve it?
Btw, I'm using Windows.
function createSharedAccessToken(uri, saName, saKey) {
uri = // '...'
saName = // '...'
saKey = // '...'
if (!uri || !saName || !saKey) {
throw "Missing required parameter";
}
var encoded = encodeURIComponent(uri);
var now = new Date();
var week = 60 * 60 * 24 * 7;
var ttl = Math.round(now.getTime() / 1000) + week;
var signature = encoded + '\n' + ttl;
var signatureUTF8 = utf8.encode(signature);
var hash = crypto.createHmac('sha256', saKey).update(signatureUTF8).digest('base64');
return 'SharedAccessSignature sr=' + encoded + '&sig=' +
encodeURIComponent(hash) + '&se=' + ttl + '&skn=' + saName;
}
The type of 'wierd looking url' you shared is eactly what encodeURIComponent is designed to return.
all character except
A-Z a-z 0-9 - _ . ! ~ * ' ( ) get replaced by escape sequences.
For example, any spaces become %20 and / becomes %2F.
A typical URL, processed by encodeURIComponent, might look like this:
https%3A%2F%2Fstackoverflow.com
When you are ready to display the original string, you simply use decodeURIComponent to reverse the process:
decodeYRIComponent('https%3A%2F%2Fstackoverflow.com');
// becomes: https://stackoverflow.com
It is well explained here, why we need to encode the URL
if a user writes Jack & Jill, the text may get encoded as Jack & Jill. Without encodeURIComponent() the ampersand could be interpreted on the server as the start of a new field and jeopardize the integrity of the data.
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURIComponent
If we need it in human readable form, we always have https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/decodeURI
Is it me or GoogleTagManager do not seem to accept base64 encoded pictures?
Exemple with the very basic code below with a very basic image.
I get the following error :
- Type : JavaScript Too Long"
- Description :
"The JavaScript in your Arbitrary HTML tag has too many contiguous non-whitespace characters (e.g. an array literal '[1,2,..]' that is too long). Try inserting spaces between statements to allow compilation (e.g. change '[1,2,...]' to '[1, 2, ...]')."
Is there no way to implement this in GTM, beside putting the js somewhere else than directly into GTM?
Best,
J.
<script type="text/javascript">
var myurl = "http://wwww.toto.com";
var myimg = "data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCACYAMoDASIAAhEBAxEB/8QAGgABAQEBAQEBAAAAAAAAAAAAAAoJCAUHBv/EACoQAAEEAgMBAAECBwEBAAAAAAAEBQYHAwgBAgkKFBE5EhMVIXi3uHR1/8QAGAEBAAMBAAAAAAAAAAAAAAAAAAMEBQb/xAAhEQACAwEAAgMBAQEAAAAAAAACAwABBAUSEwYRIRQjMf/aAAwDAQACEQMRAD8Av4AAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiAAIgACIAAiCVL0H3v+l3WiytppzRPnvpdMNHqR4nM4iVzT2UM2eYuNKwaP55K7TGRRtu3nhkoVuSRqb3VXlam2smh5V8JeqdBHMirLhw5qrThb1C/bV9Bv8Jtpv8ASE4Mjsudhw7+slp2zm8jqOXlO6vG9wpXpU3SsaFxmksnrXa3qqladIlREazVr8XOnodLm8p4VSul1+XnboX+a0pa+8zQzmXmoaYOnzP2Jb9sQi6+hEwZJTpV7g/Tj6I1i/3Jp356aAXBW8Xm6+uH2R/mONf/AIMzbGNgka5m/pFo79wl+U/yGWUMSz+oo2tQ1Zfzvx8K7IrTLMCfsj2d90fR/wA3535/0nVlB6sPN57O0RGJNbkRstsnspbY/er09MkScIJAnqIXpAmNFGkEtUubdhc3x+kyZRh7I1HEj4RJsrgu8/4rP2yL9/zdnn+kKCMzPsHWzJu9IPMxwrlpb3+wkEBSLYIxO2THhanqZJb3S54w0uebK5suLE3uL3jQo1uTI8NOPGmzZO3dzQdeOVWLou2lXP8AkPw3irrSePtdf42zoMQHu6Zo3/Bun1teLHQBayBm3StqU3ma4mYcAeZ2Lq0c9gYzVxvk/Wskhq5XJ7gYlvOlc2n5flPOw59eyyKjElZs5rY2tClArZtKxHyVadlKH2y+sp/u+nmK/fMTRqE0Y82hA2q5ZlG7Dh+SQxSrHCUNaSfyRixovQGdLMjwyRXK6uTZjSwqXKO61Nh64Y0+ZOerap+nez/vFYOiN91DoPpNry27Mb43uiiKyMM0xzvmOuoT2m8vwMMKbHOPMCyNPFgP01wtsmw8N6Owa8aoOl4aJdIJE4t/5DDm/R6C7KfSpYO01dxP0F8+NPqN1Qck0u7WVZtXzuMOM5judHD3xbD+rI3NO6d1q13LrM8DAzr8PEBXY8bYuWKci5s4T8K+nD/v74vb03Lt9T/qv5gSTAt2bqNogjc8VnhdYfF5h1eq1eF62JWTAXWfZ0tfy7nG0Ofdjm9eThUnTPTCyJUDajmfV9XRbpR6DKz18ZrTVDyWdotHe1csls66uOxT85pdRkYZ6VuxZWJ81K9Ofc/XreOAzYi7iEmn3P5/ouorkjXFR0QOuU3qA4WqOvGg/oss7dNPRbTt55s2VSD0NUnT2boVvJ9ADrt/VtH+nPmPVFWUfcrHYXRrvHW9z7yJmqeQwONZJThXWw8RrYPZeMtbLLMuNHDIy0SVVWrm9yB76Lo06SPrHntkM+92PVr6h9J4NdewVpedGh0U1cqmS5sfFmuj9glTn1hr1PEcKgTs4xiEb+OMvWLnxS+RzCrwtsMxZUihwyKVra1o06r8T2vJ36Z7lsXZyEednrBrmt1x2clDsxQKKWX3iUpqPu5Tt8YmDJB4pdFH2FhxPkDldlZVGRc1zCMr00We3+WRVlaqwh8eU8PvXUr6cf2PN4//AJNI/wDSVPEXyG34efzOtmLO1ALLCnRkIz5/UvZ2sftfqAvF49Lm5nrzpGyzXWZ69LMzc+vG0p/jq0dHsr4+kNSD29LjhsRooB24FupmeixH9MRWXctlMKx/sRevHdAa3r2pvIPTb1o+pHdysKt2Iozzj0GneudkvqxKgsFNIekLUKmaNzRwhczVYI/Od+m2Yt2ZodGJ9SYu66GKO6juh6rG9udkedL+XbH1/i569ee/HHXtzxx/Fx17c9uvHb9P78de3PXpz2445/Xjjtz06888f3569f1/Tifj5bv2OtNf/VsH/wBL2+UEHQ9zOnn9DbyULG1YOjtBeln7scu7SoF6DHwSQK/ns1UtC7pj32VkJAK8LmsbqA9rWHVmzTk/nG6rMFYehuSDgAqJlPcvwHQVtsD9a/FYeP6ABjTTgACIAAiAAIgACIAAiAAIgACIOM/RmLyacefW80LhUdfZfMZdqDsjGYpE4u0OEgksnkj7T0xbGSPx5iaU6t0ent4clSZvamptSqV7guUYEiRPmUZsePt2YCn0MY9DBuwGZLDdj04zYNVZAOlJpIxq/wAsho7Kqv8ALuqq/wAl3m7T5vRwdEAFh4NuXaCzu6Bh5XreIFdftCdroSuv2qu7r9krPyL683/rX533bCdi6NuGgpm7bgzWTNcRuqs5pVcnco2rp6kWxLIW9gnTIxOqxjUuTS6t6d2TJMiDMubXBJjUdlCNTjx55fVhrTuDZG9vnreet+oWxmz8dpuEcvch4o+orIsZvTPUTuJBMMUXf3qAxCYdIoseUOLDwizuiHv374MuZWjRuHCJTh63Zg0+lod0OxwO0B/ya/jzuVox+sQaJO5Px4/j+c2C4SG/JZ/1kNiQ+4aC6Jd3V5uRCs3M7HKYH9ObtI35tVGRLKk9Hrh1nABKISr6ILziVEJUsrOro6q6lQpP6APSu0LkqetJf8528tTxOwrJg8Jk1pSRffnaPVvH5VJWxjeJ2+9XPRuNtvZniTeuUP7n1cJCxIuUaDNwqeGzB/Gsw/VvQDfX220D3PsGUVr53OHot55WA1wVLUDHRKd47XlWs5xwRJilrW/qKyh9mTlvj2WWMcpkDk5TSlJRFlSeQQ1ojlqx1z5XRHmlkEDPohy2qvS9Dddubd21evNqXmVWZ2Zl2oSy+l7cmpNL0LfpsjNi1iq5lX4Fq9tU5WjOhS13/meR6NF6f6kOX9Ms3WKc71N9iTyi1QgBaDaMG1Qacek3t37D6+elu32lEi89tXtWFldY2GBW50cm+z5MooySdrMj8Qxx+ZRmvrHmayXWNLc7gtsJ2q+FVuggqJdGmZe+yqO5kj9Q99EdVWhdnjruNWNM1vPbcsqTtlP441XtYw+Qz2cSHI2X/VTy5dGOJxVudn927t7O3ODqu6oG9R2SNqFYuz8Y0qXPl6bVgi3ITq42XhID+PBl1t6NCBm9rujr25d/Q2Oa4iImbHZELsB8FrSoL8T0lp1aZ8Gp+Pur+QOZezco+UIiyhUkMfFqw52Ja1VVCtKrKjaXm5hsK/IUhnzow4+cCpbVo3xz1OrC66zsGnrKjim8u0hry0oZI6+nLD1d9hLTemrs8xKWNrQ/tfDmzODe7N/K5vwcLWxcjXpv5qVThy99xwDT6W4+l0NnQNYqPZoboJYXZCBNOzsRu/26q7+qu/2ZuPKONHoErOvdqd5FVVf3q0u0kP1X59CTrGr/AO3VVd/v3AAKMtQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARAAEQABEAARP/Z";
$("#beta-ad").empty();
$('<div/>', { id: "1" }).insertBefore($("#beta-ad"));
$("#1").append('<img src="' + myimg + '" style="display:inline; width: auto;" ></img>')
</script>
I think this is by design. But the workaround proposed by #Matus works.
To get around the issue of having to generate JS for a very long base base 64 encoded string I wrote a utility function, splitting the string into chunks of 150 (which GTM accepts), and generating the JS concatenation code.
You can then drop this code into your GTM tag, and reference the base64 variable.
function splitString(string, size, multiline) {
var matchAllToken = (multiline == true) ? '[^]' : '.';
var re = new RegExp(matchAllToken + '{1,' + size + '}', 'g');
var responses = string.match(re);
var value = "var base64='';";
responses.forEach(response => {
value += "base64+='" + response + "';";
});
return value;
}
var base64 = 'eyJ3aWRnZXRfc2.... etc';
var gtmString = splitString(base64, 150, true);
console.log(gtmString);
http://jsfiddle.net/azqpdwxg/2/
I have a very simple JavaScript function that works totally fine, until one of the variables has a ' in it. This is what I tried:
function search(champ1,champ2,role) {
if((champ1!='')&&(champ2!='')){
if((champ1!=champ2)) {
var champ1_name = encodeURI(champ1);
var champ2_name = encodeURI(champ2);
var role_name = encodeURI(role);
window.location.href="http://myurl.com/"+role_name+"/"+champ1_name+"&"+champ2_name;
return false;
} else if(champ1==champ2) {
window.location.href="http://myurl.com/"+role;
}
}
}
but unfortunately when I run this script the URL still has the ' in it even after they ran through encodeURI()
If you need to escape ', do something like .replace("'", "%27"). Or use a URL escaping function that lets you provide a string of characters that need to be escaped.
decodeURIComponent("%27") converts back to "'".
I have been working on this most of the morning but to no end. I am trying to execute a button that uses OnClick Java in Salesforce.com and it keeps throwing errors. I think the issue may be with special characters in the data as it works when I simply use just text. But any time numbers or any special characters are present I get the error "unexpected token ILLEGAL". Can anyone help me to see what I am doing wrong and how I can get away from failing when special characters are involved?
{!REQUIRESCRIPT("/soap/ajax/28.0/connection.js")}
var opptyObj = new sforce.SObject("Opportunity");
var caseObj = new sforce.SObject("Case");
var today = new Date();
var sOpptyId = "{!Case.Opportunity__c}";
if( sOpptyId != "")
{
alert("This case is already tied to an opportunity!");
}
else
{
opptyObj.AccountId = "{!Case.AccountId}";
opptyObj.CloseDate = sforce.internal.dateTimeToString(today);
opptyObj.Description="{!Case.Description}";
opptyObj.Case__c = "{!Case.Id}";
opptyObj.Name = "{!Case.Subject}";
opptyObj.StageName = "Estimate in Progress";
opptyObj.Created_from_Case__c = "Y";
opptyObj.Type = "New Business";
opptyObj.Amount = ".01";
var opptyresult = sforce.connection.create([opptyObj]);
if (opptyresult[0].success=='false')
{
alert("Opportunity creation failed: " + opptyresult[0].errors.message);
}
else
{
caseObj.Id = '{!Case.Id}';
caseObj.Opportunity__c = opptyresult[0].id;
caseObj.Status = "Estimate in Progress";
var caseResult = sforce.connection.update([caseObj]);
if(caseResult[0].success == 'false')
{
alert("Case update failed: " + caseResult[0].errors.message);
}
else
{
alert("An opportunity has been created and linked to this case.");
location.reload(true);
}
}
}
Assuming this is some kind of template, whatever is rendering this needs to properly escape some values in the strings it's inserting.
Given this:
opptyObj.Description="{!Case.Description}";
Let's say I enter a description consisting of this:
"That is awesome," said John.
When that is rendered in your template the result is this:
opptyObj.Description=""That is awesome," said John.";
As you might be able to see, the result is a syntax error.
You need to escape quote characters in an text inserted this way. And without knowing what is technology rendering this template I can't give you any specifics, but you want to replace " with \" and ' with \'. The \ escapes characters, forcing them to be treated as literal characters in the string instead of other special meaning.
This must be done as it's being inserted into the script. Something in the spirit of this:
opptyObj.Description="{!Case.Description.replace(/'/, "\\'").replace(/"/, '\\"')}
Exactly how to do that depends on what language or template engine is being used here. But th eresult should look like this:
opptyObj.Description="\"That is awesome,\" said John.";
Ruby on Rails implements an escape_javascript method, which sanitizes data for injection into Javascript. It does the following replacements. It seems like a good baseline.
'\\' => '\\\\'
'</' => '<\/'
"\r\n" => '\n'
"\n" => '\n'
"\r" => '\n'
'"' => '\\"'
"'" => "\\'"
UPDATE:
According to this: http://www.salesforce.com/us/developer/docs/pages/Content/pages_security_tips_scontrols.htm
It looks like you want the JSENCODE function. Something like this, perhaps?
opptyObj.Description="{!JSENCODE(Case.Description)}";
Im using soundclouds api to echo out track information but I'd like to limit the amount of characters shown for each track title result to just 24 chars? I'd also like to be able to set both the track title and artist title to be displayed as capitalised text (first letter capital rest lowercase)
Thanks
<li>Track: ' + track.title + '<BR>Artist: '+ track.user.username + '</li>'
Try this:
function formatter(str) {
if(str.length < 24) {
return str;
} else {
return str.charAt(0).toUpperCase() + str.substr(1,23) + '..';
}
}
<li>Track: ' + formatter(track.title) + '<BR>Artist: '+ formatter(track.user.username) + '</li>'
DEMO
For part 1 of your question, look at substr method. It's a standard method on all JavaScript String objects.
For part 2, capitalizing, check out this question.
You can prepare the short title in advance, first taking the substring and making sure it is lower case:
var shortTitle = track.title.substr(0,24).toLowerCase();
Then use the following to upper case the first letter and use the rest of the lowercase string, adds ...:
// ... HTML ouput by JS ...
document.write(shortTitle.charAt(0).toUpperCase() + shortTitle.slice(1));
if (shortTitle.length > 24)
document.write('...');
// ... HTML output by JS ...
Here in an example.
You can repeat these steps for the author.