Which characters are actually capable of causing SQL injection in MySQL?

An obligatory addendum from 2020: Dealing with characters was proven to be inefficient and obsoleted You must use prepared statements and forget about escaping, “dangerous characters” or any of that business. Using parameterized queries is considered the only proper way to protect from SQL injections, for the reasons provided in the original answer below: Which … Read more

Escaping backslash in string – javascript

For security reasons, it is not possible to get the real, full path of a file, referred through an <input type=”file” /> element. This question already mentions, and links to other Stack Overflow questions regarding this topic. Previous answer, kept as a reference for future visitors who reach this page through the title, tags and … Read more

Why use \x3C instead of < when generating HTML from JavaScript?

When the browser sees </script>, it considers this to be the end of the script block (since the HTML parser has no idea about JavaScript, it can’t distinguish between something that just appears in a string, and something that’s actually meant to end the script element). So </script> appearing literally in JavaScript that’s inside an … Read more