yes, that is valid in a URL encoded string (and why you have to URL encode a plus that should be a plus!)

that should work as well.

that would be wrong, it would be:


'wict.curstat?pType=2&pTypesum=' || htf.escape_sc( l_activeduesum ) ||
'&pTypemin=' || htf.escape_sc( l_activeduemin ) ))


and yes, I would if activedumsum/min were STRINGS (seems that they might be numbers, numbers are generally safe -- it is things with embedded spaces, &, <, > and so on that'll kill you every time)

Those strange characters are the character converted to an entity reference. But I doubt htf.escape_sc is doing this, as its implementation is really quite simple.

Are you doing this in SQL Workshop in HTML DB? What's your database character set?

I have no problem using htf.escape_sc on Chinese characters in HTML DB.

htf.escape_sc is definitely causing "the problem".

The implementation of escape_sc is:

function escape_sc(ctext in varchar2 character set any_cs)
return varchar2 character set ctext%charset is
begin return(replace(
replace(
replace(
replace(ctext, '&', '&' || 'amp;'),
'"', '&' || 'quot;'),
'<', '&' || 'lt;'),
'>', '&' || 'gt;'));
end;


So your entity reference of &#25105; has the ampersand being correctly replaced with '&amp;'. Thus, when it's rendered on the page, you're not seeing the browser render this entity reference into a character, you're seeing the entity reference itself.

Can I ask, are you physically storing the entity reference '&#25105;' in column comment.content? Or are you storing the character and somewhere on the way out, it's being converted to an entity reference?


I noticed you're using this in a PL/SQL region. But if this is an HTML DB report, you can change the type of the report column (by editing the report column attributes) and change the "Display As" attribute of the column to "Display as Text (escape special characters, does not save state)". This will correctly escape the data without altering your entity reference.

Joel

Well, if it were me, I'd never be storing entity references in the data in the first place, I'd just store the data. I realize there are situations where only an entity reference is applicable, but for storing Asian characters, I'd just let the database store it as is and you wouldn't be faced with this challenge.

So in your case, if you're interested in escaping the data (presumably for cross-site scripting protection) yet you don't want your Unicode character entity reference itself converted, you might have to write your own escape_sc function which will ignore them, like:

create or replace function escape_sc(ctext in varchar2) return varchar2
IS
AMP CONSTANT varchar2(10) := '&' || 'amp;';
QUOT CONSTANT varchar2(10) := '&' || 'quot;';
LT CONSTANT varchar2(10) := '&' || 'lt;';
GT CONSTANT varchar2(10) := '&' || 'gt;';
begin
return(
replace(
replace(
replace(
replace(
replace(
replace(ctext,'&#','HasH_h0ld3r'),
'&', AMP),
'"', QUOT),
'<', LT),
'>', GT),
'HasH_h0ld3r','&#'));
end;
/

This just converts your &# reference to some unique string (assumes that it would never be in your data) and then converts all other occurrences of & to an entity reference.

Joel

FYI, you may wish to take this thread over to the more appropriate HTML DB OTN forum at: </code> http://forums.oracle.com/forums/forum.jsp?forum=137

Are you sure your browser isn't first converting these to entity references somehow?  When you query this table from SQL*Plus, you see the Unicode entity references in your data?  You may wish to look in your Apache access log to see actually what is being posted.  If in there you see Unicode entity references, then that's what you're somehow submitting to HTML DB.

I just created an application on htmldb.oracle.com without issue (and without saving these characters as Unicode entity references):

http://htmldb.oracle.com/pls/otn/f?p=27775:1 <code>

(for future readers of this post, keep in mind this application may not be there or will have been changed).

Joel

The application is really quite simple. I did not use htf.escape_sc at all.

I created a table with a VARCHAR2(4000) column. I created a report on that column (select <mytext_column> from <mytable>. I edited the report column attributes and in the Display As attribute I changed that to "Display as Text (escape special characters, does not save state)". Then, I added an item called P1_DATA which is type Textarea w/ Character Counter & Spellcheck. Added a couple buttons and then added a process to insert :P1_DATA into the table. That's it. No htf.escape_sc required at all.

If you wish to determine if you're storing entity references in your data in Oracle, simply query the table.column from SQL Command Process in HTML DB or SQL*Plus. If it appears like you're storing these Unicode entity references in your data, then you need to figure out how/why they're getting there. The first place I would start is to examine the access logs of what is being posted to your page.

so, in javascript -- how do you put a quote in a string?

perhaps it is this:



How\'s this for a string?


(guessing). If so,

htf.escape_sc( replace(v_notes,'''', '\''' ) )

(not sure you want to url encode, you want to fix <>& and such...)

in sqlplus - & is a "special character", so this only applies to sqlplus:


sql> SET DEFINE OFF


then & will not be special anymore.

just use htf.escape_sc