When encoding HTML input for security, how do I avoid encoding international characters like Ñ or ñ?

I have a textarea in an ASP.NET MVC Application where the user can type some text. When I show the text to the user, I use Html.Encode to prevent malicious input. The problem is that the user can type in Spanish and maybe he types año and the Encode transforms this into a&#241o. How Can I prevent this?

EDIT: In the generated HTML, I see this:

<a href="a1-'a1'-Cama&amp;#241;o?sort=estadisticas#241;o">a1 'a1' Cama&amp;#241;o</a>

Later in the page I have this, and this time the display is correct:

<b>a1 'a1' Cama&#241;o</b>

The first is generated this way:

<%= Html.RouteLink(Html.Encode(Model.NAME),  ...... %>

and the second like this:

<%= Html.Encode(Model.NAME)%>

So my guess is that the problem is with the Html.RouteLink.

From stackoverflow

• Are you encoding twice accidentally?

  For example, if you set the Textarea's content programmatically on the server side, it will encode the content automatically on render.

  Try looking at the raw HTML output of the textarea.

  Normally when you put escapes inside textarea content, it should shows up in the textarea decoded (displayed as the intended unescaped character).

  So it might be a problem of accidentally Html.Encode twice unnescessarily.

  If your data is already escaped, you might want to un-escape (Html.Decode) it before putting it in the textarea.

  Tomalak : Same thought here. +1

  chakrit : Saw it. Still apply, no?

• So my guess is that the problem is with the Html.RouteLink

  Yep. You're not supposed to HTML-encode the parameter going into RouteLink, it generates the HTML itself and so will take care of escaping for you.

Howto rewrite phone numbers in TSQL?

I have a beginners question in TSQL.

We imported Excel Sheets into a SQL Server 2008. Too bad these excel files were not formatted the way they should be. We want a phone number to look like this: '012345678', no leading and trailing whitespace and no whitespace within. Even worse sometimes the number is encoded with a prefix '0123-2349823' or '0123/2349823'.

Normally I would export the excel file to csv, then launch some magic perl script to do the cleaning and then reimport the excel file.

Still it would be interesting to know how to do stuff like this with TSQL.

Any ideas?

From stackoverflow

• Here is a good article pertaining to SQL Server.

  : Thanks, thats an interesting article but doesn't solve the issue. Guess that whole regex, substring thingy is way easier to do in perl than in tsql.

• "Cleaned" contains only numeric value

  Depending on whether a telephone number contains "-", "/", replace them with an empty string.

  create table #t ( tel varchar(30) )
  
  insert  #t select '0123-2349823' 
  insert  #t select '0123/2349823'
  
  select  tel,
       replace(tel, 
        case
         when patindex('%-%', tel) > 0 then '-'
         when patindex('%/%', tel) > 0 then '/'
        end, '') as Cleaned
  from    #t
  

  : What is #t? Never seen that one before.

  Sung Meister : It's a temporary table I used to test so that you can simply copy and paste the code above to see if it works in your environment

• Something like

  replace(replace(rtrim(ltrim('0123-2349823')), '-', ''), '/', '')
  

  should work. Doesn't look pretty. ;)

  : That was easy :)

  Sung Meister : +1: Ha, i overthunk. This looks better than what I suggested. ;)

  Pawel Krakowiak : @nooomi: You said you like Perl... :P

• I would go about it with an update and use the 'Replace' and LTrim/RTrim functions for SQL.

  Update Table1
  set phonenum = Case
       When phonenum like '%-%' Then LTrim(RTrim(Replace(phonenum, '-', '')))
        Else LTrim(RTrim(Replace(phonenum, '/', '')))
       End
  

.NET: Animation common control for .NET?

Did Microsoft not provide a managed wrapper around the Animation common control for .NET developers?

From stackoverflow

• No, but you can get it here.

  Chris Pietschmann : Beware the solution linked to doesn't work in Windows 7 Beta.

  Ian Boyd : Is the Animation common control removed in Windows 7? Or does the random code that someone found on the internet not work?

Unexpected result from HttpURLConnection - reading remote binary file.

I'm trying to read a remote binary file (say, image) from internet like this:

HttpURLConnection connection = (HttpURLConnection) myUrl.openConnection(); //myUrl - URL object pointing for some location
if(connection.getResponseCode() == 200){
    File temp = File.createTempFile("blabla", fileName); //fileName - string name of file
    FileOutputStream out = new FileOutputStream(temp);
    int fileSize = Integer.parseInt(connection.getHeaderField("content-length"));
    int counter = 0;
    DataInputStream in = new DataInputStream(connection.getInputStream());
    byte ch[] = new byte[1024];
    System.out.println(counter);
    while((counter += in.read(ch)) > 0){
        out.write(ch);
        if(counter == fileSize){
            out.close();
            break;
        }
    }
}

Locally of with local web server (localhost) it works perfectly.

But. Then myUrl is URL of file on some remote web server - it returns unexpected results. For instance, from sources of given files it seems that it repeats some packages (I think because of corruption of previous ones or someting) and the resulting file usually is about 10% bigger than original one because of this repeats. So file is corrupted and cannot be opened correctly with image viewers.

How can I solve this?

From stackoverflow

• read does not necessarily read the entire buffer (particularly if it is at the end of the stream).

  So change your loop:

  for (;;) {
      int len = in.read(ch);
      if (len == -1) {
          break;
      }
      out.write(ch, 0, len);
  }
  

  Perhaps put that code in a method somewhere.

  Also note:

  • There is no point in using DataInputStream here (although readFully is often useful).

  • Always close resource (such as streams) with the usual idiom:

    final Resource resource = acquire(); try { use(resource); } finally { resource.close(); }

  • Probably wont make much difference, but a buffer size of 1024 is a bit small. I tend to default to 8192 arbitrarily.
  Peter Walser : Just for completion, most Java programmers prefer the shorter variant: int len; while ((len = in.read(ch)) >= 0) { out.write(ch, 0, len); } Saves one condition, a break and reuses the variable on the stack, which makes it a little less error prone.

  Tom Hawtin - tackline : A prefer to avoid side-effects. Reusing variables is not best-practice!

• Oh, just minute after asking found solution on another thread.

  Thank you, Tom, for your time and absolutely fast reply.

[Python] Is there anything that cannot appear inside parentheses?

I was intrigued by this answer to my question about getting vim to highlight unmatched brackets in python code. Specifically, I'm talking about the second part of his answer where he mentions that the C syntax highlighting is actually flagging as an error any instance of curly braces inside parens. It is an unobtrusive cue that you have unclosed parens when all of your downstream curly braces light up in red.

That trick works because C syntax doesn't allow curly braces inside parentheses. To satisfy my (morbid?) curiosity, can I do something similar with python code? Is there anything in python syntax that isn't legal inside parentheses?

Note: I'm not trolling for a better answer to my other question (there are plenty of good answers there already). I'm merely curious if this trick is even possible with python code.

From stackoverflow

• I'm not sure what are you trying to do, but how about "def" or "class"?

  this snippet is valid when it's not inside parenthesis

  class dummy: pass
  

  S.Lott : No Statement can be ()'d Only expressions.

• Any Python statement (import, if, for, while, def, class etc.) cannot be in the parentheses:

  In [1]: (import sys)
  ------------------------------------------------------------
  File "<ipython console>", line 1
    (import sys)
         ^
  <type 'exceptions.SyntaxError'>: invalid syntax
  

  Richard Levasseur : Does this include the default if-else? a = b if c else d?

  Andrew Dalke : the "b if c else d" can be in ()s because it's an expression. The assignment part ("a = ...") cannot, because in Python assignment is a statement. In Python, no statement can be in parentheses.

• Here's an exact answer:

  • http://docs.python.org/reference/expressions.html#grammar-token-expression_list
  • http://docs.python.org/reference/compound_stmts.html#function

How to create a WPF Window without a border that can be resized via a grip only?

If you set ResizeMode="CanResizeWithGrip" on a WPF Window then a resize grip is shown in the lower right corner, as below:

If you set WindowStyle="None" as well the title bar disappears but the grey bevelled edge remains until you set ResizeMode="NoResize". Unfortunately, with this combination of properties set, the resize grip also disappears.

I have overridden the Window's ControlTemplate via a custom Style. I want to specify the border of the window myself, and I don't need users to be able to resize the window from all four sides, but I do need a resize grip.

Can someone detail a simple way to meet all of these criteria?

1. Do not have a border on the Window apart from the one I specify myself in a ControlTemplate.
2. Do have a working resize grip in the lower right corner.
3. Do not have a title bar.

From stackoverflow

• If you set the AllowsTransparency property on the Window (even without setting any transparency values) the border disappears and you can only resize via the grip.

  <Window
      xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
      xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
      Width="640" Height="480" 
      WindowStyle="None"
      AllowsTransparency="True"
      ResizeMode="CanResizeWithGrip">
  
      <!-- Content -->
  
  </Window>
  

  Result looks like:

  

  ZombieSheep : Pure fluke I knew this - I was playing with the same control set myself this afternoon. :)

  Tomáš Kafka : Wow, I wouldn't expect this, but it is totally handy for make-your-own-post-it-notes-in-5-minutes, thanks :)

How do I code a rake task that runs the Rails db:migrate task?

I would like to run db:migrate VERSION=0 and then db:migrate inside of my own rake task. I am confused about how to do this. Do I need a special require statement? My rake task will reside in the lib/tasks directory of a Rails app. Thanks.

From stackoverflow

• EDIT: Rake::Task[] won't accept parameters, you have to set it in ENV. In addition, you have to reenable the task to run it multiple times.

  ENV['VERSION']= '0'
  Rake::Task['db:migrate'].invoke
  Rake::Task['db:migrate'].reenable
  ENV.delete 'VERSION'
  Rake::Task["db:migrate"].invoke
  

  NOTE: Rake::Task.reenable requires Rake 0.8.2 or higher.

  fooledbyprimes : I tried this inside of my custom rake task (residing in lib/tasks) but it failed. ("rake aborted Don't know how to build task db:migrate VERSION=0")

• Check out rake db:reset as that will accomplish what you are trying to do.

  To see what all of your rake tasks do, run rake -T

  fooledbyprimes : This is interesting but it does not really explain how to run a pre-built rails task inside of a newly created custom rake task.

  erik : Yep, since Pesto got his answer in before mine, I figured it wouldn't hurt to show you an easier way even though it didn't answer the question exactly.

  fooledbyprimes : Actually Pesto's answer didn't work.

• Is your task just dependent on having a clean db? If that's the case then you can do:

  task :my_task => [:environment, 'db:reset']

  fooledbyprimes : Okay I like this. It works. This must surely mean that the :environment task loads all the rails rake namespaces.