Question

I need to make a form with a Text Area that accepts lines of script, any kind of script be it javascript, css, html, vbscript, whatever. How can the script be passed to a form post?

EDIT: How can this script be modified so it can be inserted into a Database? Specifically SQL Server 2005

Answer 1

In the normal way, it’s just text. It only becomes “script” when you ask a script interpreter to interpret it (or a compiler to compile it; these lines are getting blurrier and blurrier). So you can include it in your form in exactly the same way you would if it were where someone should type anything else — a forum post, a question, an answer, a brief description of their job, a love letter… 🙂

Edit Re your edit follow-up, what you need to do is properly pre-process the text. This doesn’t only relate to script, you run into issues with normal text too. Here are some links addressing this in the context of SQL injection attacks, but the techniques are the same whether you’re defending against SQL injection or just trying to support having a single quote in someone’s name.

Starting with a fun comic:

http://imgs.xkcd.com/comics/exploits_of_a_mom.png

…and then referencing some useful stuff:

http://en.wikipedia.org/wiki/Sql_injection

Classic ASP SQL Injection Protection

How can I avoid SQL injection attacks?

Can I protect against SQL Injection by escaping single-quote and surrounding user input with single-quotes?