Getting parameters from URL link

Question

0.00/5 (No votes)

See more:

Hi folks,

I'm trying for my very first time, to make some web code instead of just the old application code... I worked a lot with C# language, so I decided to make ASP.NET / C#...
I'm kinda struggled at the moment, so need some help to how its done correctly, and how.

My case:
I have a news mail system, where users can visit my main site, and use two types of actions:
1. Subscribe news mail
2. Unsubscribe news mail

1. Explanation:
Subscribe news mail; it will just search the Database, to check if the email adresse is registred already. If it is, it just take out that record from DB and editting it.
If it doesn't exist already in DB, it will just create a new record in DB with user email.... (This function works as intended)

2. Explanation:
Unsubscribe news mail; To make sure that its the right user unsubscribing, I want it to be done as following scenario:
1. User type email adress, and click on "Unsubscribe".
2. the user get directed to web page, telling that an email has been sended to the typed adress with a link to confirm its the right user.
3. The user check his/her email box, and clicking on the link sended by email to them to confirm unsubscribing (eg. www.mysite.com/confirmunsub.aspx).
4. The user got a message on the site they are linked to, telling them that the email now has succesfully unsubscribed.

Its the link in the email I need som assistance to...
To make it easy for the user, I want them needing to click the link ONLY! So I think it maybe need to be some kind of POST request? with a URL like www.mysite.com/confimunsub.aspx?adressTxt=myemail@e.com .
That would be the link the user use, and when they use it, the confirmunsub.aspx will extract the information out of the post link (adressTxt field = myemail@e.com), so when the PageLoad is running, it will automatically unsubscribe the user, and all the user will need to do, is click the link in the sended email, and see the confirmation about they have been succesfully unsubscribed....

any idea?
I think that it may be possible with some kind og POST request? But I need help to the techniqe, and how it should be done correctly.

Best Regards

Posted 18-Mar-10 6:06am

grmihel2

Add a Solution

3 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

#realJSOP · Answer 1 · 2010-03-18T06:24:00

Solution 1

The page the user goes to could simply pull the email address out of the query string and perform whatever action you want, and hen present the user with the status of the action.

Where exactly is your issue?

Posted 18-Mar-10 6:24am

#realJSOP

Sandeep Mewara · Answer 2 · 2010-03-18T07:05:00

I agree to what JSOP has written above though....
I don't think this is a good way to do it. Anything in query string is visible and if you take this as a confirmation step to do it then i can tamper with it and action according to it will occur.

Example1:
UserA unsubscribed. You sent email to userA@a.com. He see's the confirmation link and changes the query string email id to userB@a.com
This can lead to someone else id un-subscribed or an invalid email id in your DB!

Example2: If this will be the model, user can guess out that not much of security is involved and thus some wild characters can be included in the email id that might affect your application/database.

Thoughts?

grmihel2 · Answer 3 · 2010-03-18T08:05:00

Answer #2:

Its true that you with some handy fixes, can make what we known as POST injections. BUT! It require you to KNOW the email adresses in the database, and the database tabel contains email adresses ONLY, with an true/false for subscription. So there ain't any real interessting information there to get.

Only security issue here, is some1 interacting with the Database, doing som injections which leads to user could get false subs. even tho they havn't confirmed themself...

Alternativly I should just add an "Unsubscribe link" at the end of each news email... That could be a way to do it also, but I havn't figured +'s and -'s for this solution yet.

No matter what, I can't see how I should get rid of POST URLs with the email info inside.

any suggestions are welcome still...

Answer #1:

The real issue is how to make automatically unsub action.

It could be some1 have experience with how they did an unsub. action to their news mail system, which is different from the way I though... any ideas will be taken to consideration :)

Getting parameters from URL link

3 solutions

Solution 1

Solution 2

Solution 3

Add your solution here

Preview 0