This is a migrated thread and some comments may be shown as answers.

Trying to filter on the (') character

3 Answers 85 Views

Grid

This is a migrated thread and some comments may be shown as answers.

This question is locked. New answers and comments are not allowed.

Matthew asked on 01 Apr 2010, 05:17 PM

Hey all. I looked and when using the filter controls built into the grid, I can properly filter on the ' character and other special characters.

However, when I am manually setting the filter in javascript, I am having a problem.

I am doing the following:

    
             var pn = $("#FilterPartNumber").val(); 
        
                var desc = $("#FilterDescription").val(); 
        
                var project = $("#Projects").val(); 
        
                var grid = $("#ItemsGrid").data("tGrid"); 
        
                grid.filterBy = "substringof(PartNumber,'" + pn + "')~and~substringof(Description,'" + escape(desc) + "')~and~substringof(PartNumber,'" + project + "')"; 
        
                grid.pageTo(1);

In my example. Ive only escaped description, because that is what I am using as my test case right now.

It translates a single quote to "%27". but this does not properly get read when calling a client-side filter. Does anyone have any suggestions on how to properly sanitize/encode the input to avoid script injection/modification attacks? Thanks. :)

Or is there a way to get the client side filter to take the escaped strings?

3 Answers, 1 is accepted

Accepted