Re: ASP web form security / validation

From: Tom Kaminski [MVP] ((A_at_T))
Date: 03/04/04 

Date: Thu, 4 Mar 2004 14:13:16 -0500

"Brian Madden" <brian@brianmadden.com> wrote in message
news:ekBvCsfAEHA.2804@tk2msftngp13.phx.gbl...
> Hello All,
>
> I'm developing a website (ASP, not ASP.NET) that allows users to post
> comments about articles. The ASP page displays the comments right out of
the
> database.
>
> I'm worried that a rogue user might add some javascript or something to
> their comment so that it executes on other users' browsers when they view
> the page.
>
> I've done a ton of searching on this, and all I can find are javascript
> validation routines that seem like they would be easy to circumvent (since
> someone could just POST to the ASP page directly). So, what do people
> usually do in these situations? Should I use a SQL trigger that checks
each
> new comment for "<!--" or something?

If you use Response.Write Server.HTMLEncode(postedcomment) you should be OK. 

-- 
Tom Kaminski IIS MVP
http://www.iistoolshed.com/ - tools, scripts, and utilities for running IIS
http://mvp.support.microsoft.com/
http://www.microsoft.com/windowsserver2003/community/centers/iis/

Relevant Pages

  • Re: A selection changes on asp page with 6 dependent list boxes, when back
    ... javascript code doesn't get processed before the form is submitted. ... > submit form every time user selects something, but I expect my asp ... >> Microsoft GTSC Developer support for Middle East ... >> courses? ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Does Macintosh read uppercase?
    ... There doesn't seem to be any error trapping in <% asp %> ... If the browser doesn't allow javascript, ... "Jim Carlock" wrote in message ...
    (microsoft.public.frontpage.programming)
  • Re: A Lot of Questions from a Noob
    ... Apache, javascript, regex, XML, etc.) I reached the level of ... they work, e.g. Ruby, PERL, Zend, SOAP. ... ASP is a serverside solution. ... Personally I like PHP and/or Perl ...
    (comp.lang.php)
  • Need to extract Querystring
    ... Lacking javascript knowledge, I just realized why my project has a bug. ... I am using ASP to loop through a set of records while it creates URLs ... with a querystring that has a single value pair. ...
    (comp.lang.javascript)
  • Re: Need to extract Querystring
    ... Lacking javascript knowledge, I just realized why my project has a bug. ... I am using ASP to loop through a set of records while it creates URLs ... with a querystring that has a single value pair. ...
    (comp.lang.javascript)
Loading