|
Hi there,
I need to prevent possible db injection attacks, I have proper validation strings in the form to replace potentially harmful characters, however there seams to be something built into .NET that screams when it sees the angle bracket followed by the word "script" before it performs any validation or string replacement function. I know hackers use these errors to thier advantage, so how can I keep the site from breaking at all if someone attempts to use this tactic to inject my database? The only solution I can think of is to use a custom generic error page - that of course reveals no info - but the fact that an error occured does.
Any suggestions? - Thanks!
|
|
|
|
|
You may want to add a validateRequest="false" in the page directive to disable the validation, and use SQL parameters to prevent potential SQL injection.
Also, read about cross site scripting (XSS) while at it b/c your may be vulnerable to it too.
|
|
|
|
|
User Parameterized queries and stop assuming that the user is feeding your application the correct data. Look at this
Introduction to SQL Injection [^]
Hope it Helps
Vuyiswa Maseko,
Few companies that installed computers to reduce the employment of clerks have realized their expectations.... They now need more and more expensive clerks even though they call them "Developers" or "Programmers."
C#/VB.NET/ASP.NET/SQL7/2000/2005/2008
http://www.vuyiswamaseko.tiyaneProperties.co.za
vuyiswa@its.co.za
http://www.itsabacus.co.za/itsabacus/
|
|
|
|
|
Hi
I have a grid view and on mousehover of each row of row of gridview, i want to display the data dynamically as tooltip showing details of row . The details may change from time to time.
I want to get them from database.
Thanks in advance
Usha
|
|
|
|
|
In OnRowDataBound event you could add javascript to get this effect
(e.Row.Style.Add())
In Word you can only store 2 bytes. That is why I use Writer.
|
|
|
|
|
Hi All
I have a web site for my client and each department is given a login id and password which is maintained in sqlserver2005 database. All the employees in that department login should login with the same id and password. Now i want to know which employee has logged in into the site.
U may question that each employee can be given each username and password which makes the work simple. But that is not my requirement.
I want to know user name of the employee who has logged in into the desktop from asp.net web page so that i can use that name in website. This site is used only within the organisation
Is there any way ?
I would be very happy if i get a solution for this.
Regards
Usha
|
|
|
|
|
nainakarri wrote: All the employees in that department login should login with the same id and password. Now i want to know which employee has logged in into the site.
|
|
|
|
|
You can use the logon_user server variable:
string logonUser = Request.ServerVariables["LOGON_USER"].ToString()
In order for the LOGON_USER variable to be populated, the user must be authenticated using either Basic or NT Challenge/Response security in IIS. If you have Anonymous Access the LOGON_USER variable will be blank. Hope that helps.
|
|
|
|
|
Hi,
I'm currently creating a site that I want to include an online data storage system that can automatically add bulk data from a spreadsheet.
I want the user to upload an excel document containing a table with the same fields as my online (MSSQL server) database and have the site add each row of the spreadsheet added to the database automatically.
I have other needs too like the obvious need to avoid repeat values without loss of data but for now I just need to know where to look to get the upload of data from an excel spreadsheet part working.
Does anybody know what sort of things I should be researching to get this sort of functionality as I'm not sure where to start?
I hope all that made sense.
Thanks
Andy
|
|
|
|
|
My suggestion:
1) Create a method where you will prompt the user for the Excel document to upload.
2) Upload the .XLS to a "working" directory giving it a unique name (include a timestamp)
3) Have a background process open the .XLS document, process the records, create an error log and when finished move the document to an "archive" folder.
4) You can create this background process as a scheduled task that gets run on your IIS server, periodically checking the "working" directory for .XLS files to process.
Sound good ? 
|
|
|
|
|
When you say spread sheet if you mean csv file it will be easier then if it is an xls file. If csv give the user the means to upload the file to the server. I've used the asp .net control for uploading which seems to work out well. Once uploaded use the filestream class to open the csv file, parse through the file for the data items, and insert them into your database.
If the files are xls you will have to do Excel automation to pull out the data from the spread sheet. You can to this client side or server side. If client side the user will need to have Excel installed. You also may have to worry about what version they have. If you do it on the server your version is not a problem but using server resoucres could be a problem if multiple people will be uploading at the same time. For server side you will have to setup a service application to process the xls files.
|
|
|
|
|
When my page loads the code behind queries the database and populates some asp labels. When the user interacts with the page java script changes the values of the asp labels on the page. When the user clicks the save button the code behind is supposed to write the changes to the lables back to the database. But the changes never get written back because I think the server side never sees the changes on the client side. Instead when the page reloads before the click event code runs the new values of the labels are replaced with original values from the server. How would I get the changes from the client side back to the server side in order to update the database correctly?
|
|
|
|
|
use ispostback(), and populate your asp labels if only is not a postback to the server. If you really wants to use server methods from java script or you want to save the data from java sctipt to database, you can use AJAX.
|
|
|
|
|
What AJAX control would I use?
|
|
|
|
|
you know that,
When page loads the code behind queries the database and populates some asp labels.
and you are right,
when the page reloads before the click event code runs the new values of the labels are replaced with original values from the server.
So populate some asp labels in page_load if and if only is not a page postback.
like,
if(!ispostback)
{
//populate some asp labels
}
hope it helps 
|
|
|
|
|
Respected Sir
I need help by u To Get AM and P.M is extension of this control i wrote code like this i devoluped one webuser control i need am and pm to this control plese send me code i wrote like below
<%@ Control Language="C#" AutoEventWireup="true" CodeFile="Time.ascx.cs" Inherits="dotnetcode_UserControls_Time" %>
<%@ Register
Assembly="AjaxControlToolkit"
Namespace="AjaxControlToolkit"
TagPrefix="ajaxToolkit" %>
<%@ Register Assembly="Validators" Namespace="Sample.Web.UI.Compatibility" TagPrefix="cc2" %>
<%@ Import Namespace="System.Threading" %>
<asp:TextBox ID="TxtTime" runat="server" Width="40px" Height="16px" />
<cc2:RequiredFieldValidator ID="Rfv" runat="server" ControlToValidate="TxtTime" Display="None"
ErrorMessage="<b>This Field Is Required</b><br />Enter Data Is Must" Font-Bold="False"
Font-Italic="False" Font-Names="Verdana" Font-Overline="False" Font-Size="Smaller"
Font-Strikeout="False" Font-Underline="False" SetFocusOnError="True" ToolTip="Field is Required"></cc2:RequiredFieldValidator>
<ajaxToolkit:MaskedEditExtender ID="MaskedEditExtender3" runat="server"
TargetControlID="TxtTime"
Mask="99:99"
MessageValidatorTip="true"
OnFocusCssClass="MaskedEditFocus"
OnInvalidCssClass="MaskedEditError"
MaskType="Time"
ErrorTooltipEnabled="True" /><%--AcceptAMPM="True"--%>
<ajaxToolkit:MaskedEditValidator ID="MaskedEditValidator3" runat="server"
ControlExtender="MaskedEditExtender3"
ControlToValidate="TxtTime"
IsValidEmpty="False"
EmptyValueMessage="Time is required"
InvalidValueMessage="Time is invalid"
Display="Dynamic"
TooltipMessage="Input a time"
EmptyValueBlurredText="*"
InvalidValueBlurredMessage="*"
/>
<ajaxToolkit:ValidatorCalloutExtender ID="VceRfv" runat="server" TargetControlID="Rfv">
</ajaxToolkit:ValidatorCalloutExtender>
|
|
|
|
|
<cc1:maskededitvalidator id="MaskedEditValidator1" runat="server"
="" controlextender="MaskedEditExtender1" controltovalidate="txtTime" display="None" invalidvaluemessage="Invalid Time">
<cc1:maskededitextender id="MaskedEditExtender1" runat="server" mask="99:99" masktype="Time" targetcontrolid="txtTime" <big="">AcceptAMPM="true">
Padmanabhan
|
|
|
|
|
I want to make an inbox page in which i have a checkbox column in gridview.I have bind all needed values.this page has a delete button.when it clicks all checked message are deleted.here is code i had tried but it didn't work.I think it is not recognized checkbox checked state.
protected void Page_Load(object sender, EventArgs e)
{
query="select brok.*,cust.FirstName+' '+cust.LastName as Name from brokermsgrecieved as brok,custdetails as cust where brok.BrokerId='"+Session["broker"]+"' and cust.CustId=brok.FromCustId";
dt = obj.select(query);
GridView1.DataSource=dt;
GridView1.DataBind();
}
protected void Button1_Click(object sender, EventArgs e)
{
int count =GridView1.Rows.Count;
for (int i = 0; i < count; i++)
{
CheckBox chk =(CheckBox)GridView1.Rows[i].FindControl("checkbox1");
if (chk.Checked)
{
query = "delete from brokermsgrecieved where MsgId='"+id+"'";
obj.delete(query);
}
}
}
|
|
|
|
|
In your case the gridview is getting binded on every post back. That is why you are loosing the value. Put the code in page load under (!Page.IsPostBack).
Apurva Kaushal
|
|
|
|
|
jainiraj wrote: query = "delete from brokermsgrecieved where MsgId='"+id+"'";
what is id here ? I dont see in the code. Do you update it ?
|
|
|
|
|
Hi All
I Have One Doubt i am using TabContainer with in that i took 3
tabpanel out side of Tabcontainer I Have Save Button I need To
Replace The Save Button Name As Next And when Final TabPanel
Using I need to get save button please send me code for this
|
|
|
|
|
Hi,
I have created an Master Page that resides within my root folder. I wanted to resuse this Master Page across various applications hosted in IIS. But in doing so I get the below [1] error. I googled and found following link
http://weblogs.asp.net/dwahlin/archive/2005/11/16/430779.aspx
To be more specific here is what I wanted to achieve
I have a master page @ following location
C:\Inetpub\wwwroot\Common\TemplateMaster.master
I wanted to use this master page across various applications
i.e. I wanted this master page to be used by various .aspx pages of my below applications
C:\Inetpub\wwwroot\SampleApp1\Page1.aspx
C:\Inetpub\wwwroot\SampleApp2\Page1.aspx
Following is the code for Master Page implementation within the C:\Inetpub\wwwroot\SampleApp1\Page1.aspx web page
<%@ Page Language="C#" MasterPageFile="/intranet/Common/TemplateMaster.master" CodeFile="Page1.aspx.cs" Inherits="Page1" Title="Page 1" %>
Now after the above implementation, when I try to build my SampleApp1 website, I encounter below [1] error
Is it possible to achieve this? If yes, then is there is any better way to achieve the above functionalities other than that shown in the above link?
[1]The virtual path '/intranet/Common/TemplateMaster.master' maps to another application, which is not allowed.
Regards,
Vipul Mehta
modified on Wednesday, May 27, 2009 11:03 PM
|
|
|
|
|
|
I could find many alternates are available to share a master page across various applications like, Using Version control system, Share it in a DLL... Google it you will get more.
|
|
|
|
|
Hi All,
Is there any posibility to assign controltovalidate as label
for any of the validation controls
and
also i want a required field validator with label can it be possible or not?
i tried to make use of controltovalidate as label but i got an error as
control to validate is required........
Regards,
Koti
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
