# Sanitizing user comment entries text field help

**URL:** <https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817>\
**Category:** Ignition\
**Created:** [March 30, 2022, 2:23pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817 "2022-03-30T14:23:18Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![zacharyw.larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/zacharyw.larson/32/23749_2.png) [@zacharyw.larson](https://forum.inductiveautomation.com/u/zacharyw.larson)\
**Post date:** [March 30, 2022, 2:23pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/1 "2022-03-30T14:23:18Z")

</div>

On the button Submit mouse up I have a script with this:

```auto
Comments = self.parent.parent.getChild("topspacer flex_5").getChild("TextField_0").props.text
	Comments = Comments.replace('?', ' ')
	Comments = Comments.replace('!', ' ')
	Comments = Comments.replace('#', '_')
	Comments = Comments.replace('%', ' ')
	Comments = Comments.replace('^', ' ')
	Comments = Comments.replace('*', ' ')
	Comments = Comments.replace('~', ' ')
	Comments = Comments.replace('[', ' ')
	Comments = Comments.replace(']', ' ')
	Comments = Comments.replace('{', ' ')
	Comments = Comments.replace('}', ' ')
	Comments = Comments.replace('+', ' ')
	Comments = Comments.replace('=', ' ')
	Comments = Comments.replace('`', ' ')
	Comments = Comments.replace('\\', ' ')
	Comments = Comments.replace('/', '_')
	Comments = Comments.replace('"', ' ')
	Comments = Comments.replace('\'', ' ')
	Comments = Comments.replace('$', ' ')
	Comments = Comments.replace('|', ' ')
	Comments = Comments.replace(',', '_')	

```

it clearly says to replace the “]” with a ’ ’

However, 40 lines of code later I call a runPrepupdate.  
In the log I can see someone tried a few times to submit a comment with a “]” on the end.

Then also, I want to limit the text length in this script.

---

<div class="post-metadata">

**Author:** ![victordcq](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@victordcq](https://forum.inductiveautomation.com/u/victordcq)\
**Post date:** [March 30, 2022, 2:32pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/2 "2022-03-30T14:32:15Z")

</div>

you can chain replaces

```auto
Comments = (
  Comments
  .replace('?', ' ')
  .replace('!', ' ')
  .replace('#', '_')
  .replace('%', ' ')
  )

```

you can limit the lenght like this `Comments = Comments[:50]`  
(which can also be chained)

---

<div class="post-metadata">

**Author:** ![peter](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@peter](https://forum.inductiveautomation.com/u/peter)\
**Post date:** [March 30, 2022, 2:36pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/3 "2022-03-30T14:36:46Z")

</div>

This may seem like a stupid question, but what is the goal of your script? Are you trying to sanitize user input to avoid SQL injection attacks? Because that’s what I thought the [system.db.runPrepUpdate](https://docs.inductiveautomation.com/display/DOC81/system.db.runPrepUpdate) was supposed to do.

---

<div class="post-metadata">

**Author:** ![zacharyw.larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/zacharyw.larson/32/23749_2.png) [@zacharyw.larson](https://forum.inductiveautomation.com/u/zacharyw.larson)\
**Post date:** [March 30, 2022, 2:37pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/4 "2022-03-30T14:37:59Z")

</div>

I am trying to make the runprepupdate not fault out so I can put the user comments on the reports.

thanks again Victor, I kept looking at this one set of code and was so confused, but when you wrote it, I was like oh it is slicing haha

---

<div class="post-metadata">

**Author:** ![victordcq](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@victordcq](https://forum.inductiveautomation.com/u/victordcq)\
**Post date:** [March 30, 2022, 2:41pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/5 "2022-03-30T14:41:24Z")

</div>

> [@zacharyw.larson](#):
>
> runprepupdate not fault out

This should not fault out tho :o How are you using it?  
(at least not because of user inputing a string)

---

<div class="post-metadata">

**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\
**Post date:** [March 30, 2022, 2:45pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/6 "2022-03-30T14:45:30Z")

</div>

Wrap it in a try / except block. Upon exception, tell the user he screwed up.

---

<div class="post-metadata">

**Author:** ![zacharyw.larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/zacharyw.larson/32/23749_2.png) [@zacharyw.larson](https://forum.inductiveautomation.com/u/zacharyw.larson)\
**Post date:** [March 30, 2022, 2:51pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/7 "2022-03-30T14:51:10Z")

</div>

Thanks

Is there a way to check how many varchars a column was set for in Ignition?

I might put just limit to 80 characters.

Comments come into a text field.  
Submit button runs a script.  
Gets the comment.  
supposed to sanitize it…  
then puts it into the runprepupdate

However, I was getting a ] on the end when I look at the logs for the error running the script.  
So maybe too many characters were being used and the error just puts a ] there

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [March 30, 2022, 2:56pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/8 "2022-03-30T14:56:54Z")

</div>

I would use Regular Expressions for this, and condense the code significantly.

```python
import re

Comments = self.parent.parent.getChild("topspacer flex_5").getChild("TextField_0").props.text
Comments = re.sub('[#/,]','_',re.sub('[\?!%\^\*~\[\]\{\}\+=`\\"$|]',' ',Comments))

```

Also, I would tend to not let them input a string longer than acceptable. As in rather than just accepting and then stripping the text, don’t allow them to enter any characters past that point.

The first leads the user to believe what they entered was successfully processed _as they entered it_ rather than as it was actually processed.

---

<div class="post-metadata">

**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\
**Post date:** [March 30, 2022, 2:58pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/9 "2022-03-30T14:58:31Z")

</div>

If you can standardize on a single replace character, the regex becomes simpler.

```python
import re

Comments = self.parent.parent.getChild("topspacer flex_5").getChild("TextField_0").props.text

pattern = re.compile('[^a-zA-Z0-9 -]')

Comments = pattern.sub('', Comments)

```

---

<div class="post-metadata">

**Author:** ![zacht](https://avatars.discourse-cdn.com/v4/letter/z/ea5d25/32.png) [@zacht](https://forum.inductiveautomation.com/u/zacht)\
**Post date:** [March 30, 2022, 3:01pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/10 "2022-03-30T15:01:50Z")

</div>

> [@victordcq](#):
>
> This should not fault out tho :o How are you using it?  
> (at least not because of user inputing a string)

I'm still somewhat confused why you have to escape these characters when properly using `runPrepUpdate`. When supplied as parameters do these cause a fault?

Can you post the error message you get when the characters are not escaped?

---

<div class="post-metadata">

**Author:** ![zacharyw.larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/zacharyw.larson/32/23749_2.png) [@zacharyw.larson](https://forum.inductiveautomation.com/u/zacharyw.larson)\
**Post date:** [March 30, 2022, 3:02pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/11 "2022-03-30T15:02:29Z")

</div>

how do you not let them put in text that is too long?

hand slapper on their keyboard? jk

---

<div class="post-metadata">

**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\
**Post date:** [March 30, 2022, 3:08pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/12 "2022-03-30T15:08:17Z")

</div>

You were asked a couple of times why you are stripping those characters from the user comments but you didn’t explain.

---

<div class="post-metadata">

**Author:** ![zacharyw.larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/zacharyw.larson/32/23749_2.png) [@zacharyw.larson](https://forum.inductiveautomation.com/u/zacharyw.larson)\
**Post date:** [March 30, 2022, 3:09pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/13 "2022-03-30T15:09:58Z")

</div>

See comment 6 7

I have tried to answer those questions.  
Probably there is a gap between my understanding and your expectation in an answer I think.  
I am doing my best to read the content recommended and learn it.

---

<div class="post-metadata">

**Author:** ![peter](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@peter](https://forum.inductiveautomation.com/u/peter)\
**Post date:** [March 30, 2022, 3:12pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/14 "2022-03-30T15:12:42Z")

</div>

Personally I think that sanitizing the user input in this fashion is counter productive.

Assuming a non-malicious actor, the user has explicitly entered a richly formatted comment, which the system then helpfully cleans up. Thus what is saved in the system is not what the user entered, and the user has no idea that the difference exists.

But because we should always assume a malicious actor, the system should be able to cope with any user entered data and not crash and burn due to a craftily formatted input. But IMHO filtering text is not the preferred way to do it. (See [SQL Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html) for example, where input filtering is the last of the suggested methods)

---

<div class="post-metadata">

**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\
**Post date:** [March 30, 2022, 3:14pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/15 "2022-03-30T15:14:01Z")

</div>

Hence, my first comment.

> [@JordanCClark](#):
>
> Wrap it in a try / except block. Upon exception, tell the user he screwed up.

---

<div class="post-metadata">

**Author:** ![zacharyw.larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/zacharyw.larson/32/23749_2.png) [@zacharyw.larson](https://forum.inductiveautomation.com/u/zacharyw.larson)\
**Post date:** [March 30, 2022, 3:18pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/16 "2022-03-30T15:18:40Z")

</div>

ah, I can check the length in the except section, got it

---

<div class="post-metadata">

**Author:** ![zacharyw.larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/zacharyw.larson/32/23749_2.png) [@zacharyw.larson](https://forum.inductiveautomation.com/u/zacharyw.larson)\
**Post date:** [March 30, 2022, 3:34pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/17 "2022-03-30T15:34:01Z")

</div>

Thanks for the help, and sorry I didn’t see this question. The posts were rapid for me. I was also trying to researching things that were said and read recommended pages. sorry

@zacht  
The error is

```auto
JythonExecException:
Traceback (most recent call last): File "", line 58, in runAction 

```

farther down

```auto
java.lang.Exception:
Error executing system.db.runPrepUpdate(

```

It spit out my insert along with the data that was getting stuffed into it

Among that data, the only thing that I saw which was suspect was this “]” on the end of the comments.

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [March 30, 2022, 3:39pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/18 "2022-03-30T15:39:58Z")

</div>

I think the question is less about the error and more about, why you need to remove all of these characters from the string.

What is the intent behind the sterilization?

---

<div class="post-metadata">

**Author:** ![zacharyw.larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/zacharyw.larson/32/23749_2.png) [@zacharyw.larson](https://forum.inductiveautomation.com/u/zacharyw.larson)\
**Post date:** [March 30, 2022, 3:41pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/19 "2022-03-30T15:41:26Z")

</div>

to remove that “]” which is in the error

or anything like that

to get the script to not fault, or to make it work on try before except now

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [March 30, 2022, 3:42pm UTC](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817/20 "2022-03-30T15:42:32Z")

</div>

You are replacing 20 other characters. Why?

[Next page](https://forum.inductiveautomation.com/t/sanitizing-user-comment-entries-text-field-help/57817.md?page=2)