|
Hi all developers!!
I am looking for someone to please help me write a regular expression that I can use for my textarea control. It must search for all means of bad characters that can lead to a SQL injection attack. I would appreciate it if someone could send me some source code.
Thanks
Brendan
|
|
|
|
|
|
|
So many characters could lead to an attack it mostly depends on the combination they are used. For example, do you deny the apostrophe? What happens if someone tries to enter the name "Miles O'Brian"?
Your best bet is to make sure you use parameterised queries to insert the information into the database. Remember to run on a least privilaged account (say giving the user only SELECT permission on the relevant tables and nothing more - remember you can also REVOKE permission at the column level in SQL Server).
Can you let us know the purpose of the textarea? What is the information going to be used for? That might also help defining the measures to put in place to reduce the "attack surface".
My: Blog | Photos
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More
|
|
|
|
|
I have an asp application in which, a page generates reports depending upon the id passed to it. For eg. printpage.asp?id=52 . Now I have a Print button on this page on clicking of which the contents of the page should be read and passed to the activex dll which I have prepared for printing the page.( I had to do this because the printer is installed on the server where the application resides).
Now my question is how to read the contents in such a way that the fonts and formatting should remain the same, as that content will be printed on the server printer using Active X dll.
|
|
|
|
|
I posted this message. Please help me out. Its bit urgent.
Thanks in advance.
|
|
|
|
|
Hi,
When I use window.open() in a page from IE, IE will launch a new window but stay in the same process. But when I use the same page from an IE control in my own app, it launches a new process (a new ie instance is created).
For a certain reason, I cannot use showModal/ModelessDialog. My question is: is there a way to force IE to launch a new window without generating a new process.
Thanks
|
|
|
|
|
Just to clarify: the new IE window is also for showing a webpage, not a popup dialog
|
|
|
|
|
Hi i have a problem in using safe array concept. I wrote the following code for getting the values from three text boxes.
<%
j = Request.BinaryRead(Request.TotalBytes)
for i= 1 to Request.TotalBytes
Response.Write midB(j,i,1)
Next
%>
The Out put of this is :
Username=wa&FatherName=wasa&UserPassword=aw&button2=Submit+Query
But i want then out put like this :
1. Username=wa
2. FatherName=wasa
3. UserPassword=aw
How could this be done.that i have the out put in the form of list.
KO
|
|
|
|
|
I've encountered an interesting problem to which I can't seem to find a solution.
I've got an ASP.NET application, written in C#, that returns a variable called TimeToRefresh each time that the page loads. This variable is determined dynamically, represents the number of milliseconds before the page needs to automatically refresh, and could be any positive integer.
Since I need an automatic page refresh, that necessitates JavaScript (if there's another client-side method for automatic page refresh that could be adapted to this problem, please let me know). I need to implement, therefore, a JavaScript timer that counts down the number of milliseconds indicated in the TimeToRefresh variable. Here's the rub: I can't find a way to transfer the variable from ASP.NET to JavaScript. I need to either: a.) access an ASP control from JavaScript, or b.) populate an html control from ASP that can then be accessed by JavaScript. I can't seem to do either successfully.
Any ideas? Another method entirely, perhaps?
Thanks for your help!
|
|
|
|
|
|
You could add a html hidden control to the page and make it server side (right click / run at server). Then you can populate the control server side and read it from javascript via getElementById(idOfHiddenElement).
|
|
|
|
|
In my application, in one page, I have provided a facility to upload files of type .doc, .jpg, .gif etc. After uploading the file successfully, when click on that file to see, error message appears saying that this file is corrupt, can't open. Oracle is being used as database. The application is developed in ASP. Can some one tell me what can be the reason behind this?
|
|
|
|
|
Hi,
After i connect to a webhosting service provider
i see an error dialog box which tells me that there is an error in the script on this page then when i try to remove a project that i have uploaded i cant! because i dont see it in the Remove list and
I dont know How to solve this problem.
I hope that someone could help me..
|
|
|
|
|
Could you explain much more?
|
|
|
|
|
I have upload my project using VS.net 2003 on a website(by using a web hosting service).The problem is that i cant remove it when i want to because i cant see the folder of the project in the Remove List...
|
|
|
|
|
Set wshell = CreateObject("WScript.Shell")
wshell.Run "any_thing_to_run"
the above two lines are vbscript code . can any please help and tell me their javascript equivalent code.
Be FaithFull To Your Work.
|
|
|
|
|
alert("I am an idiot and I keep asking the same question over and over, because I don't believe the answer people keep giving me.")
sheesh.
Christian Graus - Microsoft MVP - C++
|
|
|
|
|
|
Hi,
I have a webpage which lists names of files. Whenever a user clicks on the file name(a hyperlink) the relevant rtf document opens in a MS-Word window.
My question is how to print the file without opening the file in MS-Word. This process has to happen without user intevention.
Thanks for any help
Thanks and Regards
Vikram Attiganal
|
|
|
|
|
If all the information that you have to print is on the single page of IE , then its very simple, first install the printer and then go to file menu and simply click the print option.
If you want to do it programmatically then you have to choose a scripting language.For java script make a button with caption Print and on it onClick event call a function Printme(user defined) and in this function write the print routine which is i think window.print.
Hope it will work.
Be FaithFull To Your Work.
|
|
|
|
|
Problem (succinct): Say you want some of your paragraphs to have no top and bottom margin, and you want other paragraphs to have 12pt top and bottom margins. This can be done through styles. But then if you try to apply Trenton Moss's 4th HTML speedup tip, and place a 'div' around the block of paragraphs, rather than < P style=NoMargins>... it fails to work. Anybody know how to get around it, and have flexible paragraph margins on a style by style basis?
More vaguely describing the problem: The first try using styles may look like:
.NoMargin {
margin-top: 0px;
margin-bottom: 0px;
}
.Margin {
margin-top: 12px;
margin-bottom: 12px;
}
And using it in code looks like:
< P style=NoMargin>Paragraph1.</P>
< P style=NoMargin>Paragraph2.</P>
< P style=Margin>Paragraph3.</P>
< P style=Margin>Paragraph4.</P>
And that works. But then when you go
<div class=NoMargins>
< P>Paragraph1.</P>
< P>Paragraph2.</P>
</div>
<div class=Margins>
< P>Paragraph3.</P>
< P>Paragraph4.</P>
</div>
It fails miserably. In fact, it hooks onto the default 'P' margin-top and margin-bottom values, and doesn't look at the Margins OR NoMargins definition of margin-top or margin-bottom.
The only work-around I have found is to define:
P {
margin-top: 0px;
margin-bottom: 0px;
}
and these values are what is used throughout. I cannot figure out how to get different margins around a style, other than going back to the first method ("< P class=Margin>...")
David
|
|
|
|
|
You didn't read Trenton's example carefuly.
He has:
<div class="text">
<p>This is a sentence</p>
<p>This is another sentence</p>
<p>This is yet another sentence</p>
<p>This is one more sentence</p>
</div>
.text p
{
color: #03c;
font-size:2em
}
As you can see, whole trick is in ".text p" - which means "apply this style to childs of .text". You don't have this in your CSS - there should ne ."NoMargin p".BTW you have class=NoMargins instead od class=NoMargin. I assume this is just typo.
David
David
|
|
|
|
|
Thank you. I could have sworn myself black and blue that I tried that combo and every other combo among all the things I tried. Yet it works this time!
Can you explain the difference between the declarations: ".text p { ..." and ".text { ..." in this case? I do not understand the semantic difference between these two, and it confuses the heck out of me. I was under the impression that ".text { ..." declared a class called 'text', and that placing " < div class="text">" said: "use the class 'text' for the paragraphs in this division", but my understanding must be missing something, otherwise the 'margin' specifications would automatically apply on a per-paragraph basis?
OH! As I am writing this, and playing around, it finally sinks in. Your:
".text p" - which means "apply this style to childs of .text"
is wrong (I believe). It should be: "'.text p {...' means 'create a style named 'text' with paragraph properties of ..." In the same vein, "'.text { ...' says: "create a style with the attributes of ...", and then when you use that style in a division, it applies the margins to the top and bottom of that division, rather than the paragraphs in between.
Did I get the semantics right this time, and is there anything else I am missing? What other things besides 'p' can go in place of the 'p' in ".text p { ..."?
Again, thanks very much.
David
|
|
|
|
|
David O'Neil wrote:
Can you explain the difference between the declarations: ".text p { ..." and ".text { ..." in this case?
yes
David O'Neil wrote:
was under the impression that ".text { ..." declared a class called 'text', and that placing " < div class="text">" said: "use the class 'text' for the paragraphs in this division", but my understanding must be missing something, otherwise the 'margin' specifications would automatically apply on a per-paragraph basis?
you are right that .text create class called 'text'. But it's not "use the class 'text' for the paragraphs in this division" when you write <div class="text">. It's "use the class 'text' for this division". So your <div> element had margins as set in .text class, not paragraphs.
David O'Neil wrote:
Your:
".text p" - which means "apply this style to childs of .text"
is wrong (I believe).
hmm I admit what I wrote is not exact. Should be "apply this style to child paragraphs of element of 'text' class". What I meant is called selector.
David O'Neil wrote:
Did I get the semantics right this time, and is there anything else I am missing?
I think you got it right  Look at CSS for more information about CSS, selectors in this case.
David O'Neil wrote:
What other things besides 'p' can go in place of the 'p' in ".text p { ..."?
All of them. Again, read about CSS in link I gave you ( on that page are links to CSS1,2,3 specifications).
David
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
