ASP.NET

vb function / sub call using javascript .

27-Feb-15 10:31

Your code is vulnerable to SQL Injection[^].

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Member 815140727-Feb-15 8:13

Member 8151407

27-Feb-15 8:13

Public Sub ia()

end sub

i just want to call this function in side javascript code ?

Re: vb function / sub call using javascript .

ZurdoDev27-Feb-15 9:35

ZurdoDev

27-Feb-15 9:35

You would have to put your VB code into a webservice or into something (like a page) that JavaScript can call.

There are only 10 types of people in the world, those who understand binary and those who don't.

"End of statement Expected" error

samflex27-Feb-15 5:11

27-Feb-15 5:11

I have several fieldnames from the database, one form field from markup called ddlPartySize.SelectedValue and one variable from codebehind.

I am trying to form a hyperlink on code behind but getting End of Statement Expected error message.

Any ideas how to resolve this?

Thanks in advance:

PHP

Private Sub gvCustomers_RowDataBound(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.GridViewRowEventArgs) Handles gvCustomers.RowDataBound
    If e.Row.RowType = DataControlRowType.DataRow Then
        Dim hl As HyperLink = CType(e.Row.FindControl("hdReserve"), HyperLink)
        If hl IsNot Nothing Then
            hl.NavigateUrl = "<%# String.Format("ReserveFacility.aspx?id={0}&groupsize={1}&facilityFees={2}&depoitAmt={3}&cancelAmt={4}&keydeptAmt={5}&extrahour={6}&hoursdiff={7}", CType(Container.DataItem, System.Data.DataRowView)("siteId") , ddlPartySize.SelectedValue,CType(Container.DataItem, System.Data.DataRowView)("RentalFeeAmount"),CType(Container.DataItem, System.Data.DataRowView)("DepositAmount"),CType(Container.DataItem, System.Data.DataRowView)("CancellationAmount"),CType(Container.DataItem, System.Data.DataRowView)("DepositAmount"),CType(Container.DataItem, System.Data.DataRowView)("ExtraHourAmount"),hourDiff %>"
        End If
    End If
End Sub

I use the code on markup below, it works except hourDiff from ValidateDuration sub on codebehind.

PHP

 <asp:TemplateField HeaderText="Select" SortExpression="siteid">
  <ItemTemplate>
      <asp:HyperLink ID="hdReserve" class="js_siteid"  AutoPostBack="false" runat="server" Text="Select"
        Navigateurl='<%# String.Format("ReserveFacility.aspx?id={0}&groupsize={1}&facilityFees={2}&depoitAmt={3}&cancelAmt={4}&keydeptAmt={5}&extrahour={6}", CType(Container.DataItem, System.Data.DataRowView)("siteId") , ddlPartySize.SelectedValue,CType(Container.DataItem, System.Data.DataRowView)("RentalFeeAmount"),CType(Container.DataItem, System.Data.DataRowView)("DepositAmount"),CType(Container.DataItem, System.Data.DataRowView)("CancellationAmount"),CType(Container.DataItem, System.Data.DataRowView)("DepositAmount"),CType(Container.DataItem, System.Data.DataRowView)("ExtraHourAmount")) %>' />
  </ItemTemplate>
</asp:TemplateField>

PIEBALDconsult27-Feb-15 5:25

PIEBALDconsult

27-Feb-15 5:25

I expect you need to escape some quotes, but that's just a guess.

Richard Deeming27-Feb-15 6:28

27-Feb-15 6:28

You have a combination of incorrect quotes and a missing closing parenthesis.

Try something like this:

ASP.NET

<asp:TemplateField HeaderText="Select" SortExpression="siteid">
    <ItemTemplate>
        <asp:HyperLink ID="hdReserve" class="js_siteid"  AutoPostBack="false" runat="server" Text="Select"
            NavigateUrl='<%# String.Format("ReserveFacility.aspx?id={0}&groupsize={1}&facilityFees={2}&depoitAmt={3}&cancelAmt={4}&keydeptAmt={5}&extrahour={6}&hoursdiff={7}", CType(Container.DataItem, System.Data.DataRowView)("siteId") , ddlPartySize.SelectedValue, CType(Container.DataItem, System.Data.DataRowView)("RentalFeeAmount"), CType(Container.DataItem, System.Data.DataRowView)("DepositAmount"), CType(Container.DataItem, System.Data.DataRowView)("CancellationAmount"), CType(Container.DataItem, System.Data.DataRowView)("DepositAmount"), CType(Container.DataItem, System.Data.DataRowView)("ExtraHourAmount"), hourDiff) %>'
        />
    </ItemTemplate>
</asp:TemplateField>

If you're using .NET 4.5, you can simplify that code by using a strongly-typed data control[^]. Just add ItemType="System.Data.DataRowView" to your data-bound control, and then replace each instance of:

VB.NET

CType(Container.DataItem, System.Data.DataRowView)("...")

with:

VB.NET

Item("...")

If you're using an earlier version, you could still make the code easier to read by using Eval:

VB.NET

Eval("...")

However, that will perform very slightly slower - you'd need to run some performance tests on your code to see if the difference was a problem.

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

samflex27-Feb-15 6:40

27-Feb-15 6:40

Hi Richard, *always* fantastic to hear from you.

That ValidateDuration sub is actually yours you helped me out with sometime last year.

Just a refresher, here it is again:

PHP

 Protected Sub ValidateDuration(ByVal sender As Object, ByVal args As ServerValidateEventArgs)
    Dim validator As Control = DirectCast(sender, Control)
    Dim row As Control = validator.NamingContainer
   Dim startHour As Integer = Integer.Parse(DirectCast(row.FindControl("startHour"), DropDownList).SelectedValue)
    Dim startMinutes As Integer = Integer.Parse(DirectCast(row.FindControl("startMinutes"), DropDownList).SelectedValue)
    Dim startAmPm As String = DirectCast(row.FindControl("startAmPm"), DropDownList).SelectedValue

    Select Case startAmPm
        Case "AM"
            If True Then
                If startHour = 12 Then
                    startHour = 0
                End If
                Exit Select
            End If
        Case "PM"
            If True Then
                If startHour <> 12 Then
                    startHour += 12
                End If
                Exit Select
            End If
        Case Else
            If True Then
                args.IsValid = True
                Return
            End If
    End Select

    Dim endHour As Integer = Integer.Parse(DirectCast(row.FindControl("endHour"), DropDownList).SelectedValue)
    Dim endMinutes As Integer = Integer.Parse(DirectCast(row.FindControl("endMinutes"), DropDownList).SelectedValue)
    Dim endAmPm As String = DirectCast(row.FindControl("endAmPm"), DropDownList).SelectedValue

    Select Case endAmPm
        Case "AM"
            If True Then
                If endHour = 12 Then
                    endHour = 0
                End If
                Exit Select
            End If
        Case "PM"
            If True Then
                If endHour <> 12 Then
                    endHour += 12
                End If
                Exit Select
            End If
        Case Else
            If True Then
                args.IsValid = True
                Return
            End If
    End Select

    hourDiff = endHour - startHour
    If endMinutes < startMinutes Then
        hourDiff -= 1
    End If
    'Response.Write(hourDiff)
    'Response.End()
    args.IsValid = hourDiff >= 4
End Sub

I moved hourDiff definiation at class level outside the sub so I can append the value of it to hyperlink control id of hpReserve.

Just having a couple of problems doing so.

One, as you can see, the hourDiff is not a database field. So, I can't use eval(...).

So, it is giving an error that hourDiff is unaccessible.

Second, I keep getting ValidateDuration is undefined when using it to ensure that a minimum of 4 hours is selected.

Any thoughts?

Richard Deeming27-Feb-15 8:04

27-Feb-15 8:04

OK, so it's this thread[^] from back in July?

If you make the hourDiff a public or protected field, it should be available to the data-binding code. However, it won't be populated until the custom validator has run, which isn't going to happen until the user has selected the start and end hours and posted them back to the server.

In this case, building the NavigateUrl on the server isn't going to work. You're going to need some javascript to update the URL on the client.

Start with the fixed elements which you know on the server:

ASP.NET

<asp:HyperLink ID="hdReserve" class="js_siteid"  runat="server" Text="Select"
    NavigateUrl='<%# String.Format("ReserveFacility.aspx?id={0}&facilityFees={1}&depoitAmt={2}&cancelAmt={3}&keydeptAmt={4}&extrahour={5}", Eval("siteId"), Eval("RentalFeeAmount"), Eval("DepositAmount"), Eval("CancellationAmount"), Eval("DepositAmount"), Eval("ExtraHourAmount")) %>'
/>

Then add some javascript to modify the URL when the controls change. Something like this should work:

JavaScript

$(function(){

    var parseTime = function(container, prefix){
        var hour = parseInt(container.find("select[name$=" + prefix + "Hour]").val(), 10);
        var minutes = parseInt(container.find("select[name$=" + prefix + "Minutes]").val(), 10);
        var amPm = container.find("select[name$=" + prefix + "AmPm]").val();

        switch (amPm) {
            case "AM": {
                if (hour === 12) { hour = 0; }
                break;
            }
            case "PM": {
                if (hour !== 12) { hour += 12; }
                break;
            }
            default: {
                return null;
            }
        }

        return { hour: hour, minutes: minutes };
    };

    // TODO: Check that this selector returns the correct elements:
    $("a.js_siteid").each(function(){

        var me = $(this);
        var row = me.closest("tr");
        var baseUrl = me.attr("href");

        row.on("change", "select[name$=ddlPartySize], select[name$=Hour], select[name$=Minutes], select[name$=AmPm]", function(){

            var url = baseUrl;
            var groupSize = row.find("select[name$=ddlPartySize]").val();
            if (groupSize) { url += "&groupsize=" + encodeURIComponent(groupSize); }

            var startTime = parseTime(row, "start");
            var endTime = parseTime(row, "end");
            if (startTime && endTime){
                var hourDiff = endTime.hour - startTime.hour;
                if (endTime.minutes < startTime.minutes) { hourDiff--; }
                url += "&hoursdiff=" + hourDiff.toString();
            }

            me.attr("href", url);
        });
    });
});

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

samflex27-Feb-15 9:03

27-Feb-15 9:03

Thanks so much sir but there is a little problem though and I suspected we would have this problem as soon as I saw your solution but I wanted to try it anyway.

First, the hyperlink doesn't become exposed to the javascript until after the search button is clicked.

Then it becomes available.

Right now, the groupsize and the hoursdiff do not show up on the hyperlink.

Many thanks sir.

Richard Deeming27-Feb-15 10:29

27-Feb-15 10:29

I can't see anything in the code you've posted relating to a search button, or hiding the hyperlink.

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

samflex27-Feb-15 10:44

27-Feb-15 10:44

You are correct sir, my bad.

As stated, the code I posted there and the js version of it were created by you and they worked great.

The issue started when users of the app indicated that they would also like to warn users that there is a set fee for 4 hours use of their facility.

If they went over the 4 hour limit, there would additional fees.

As a result, I just managed, with some googling, to modify your script slightly to come up with the code below:

<script type="text/javascript">
              $(window).load(function () {
                  $("#txtFromDate").datepicker();
                  $('#timeStart').timepicker({ showPeriod: true,
                      onHourShow: OnHourShowCallback,
                      onMinuteShow: OnMinuteShowCallback
                  });

                  $("#txtToDate").datepicker();
                  $('#timeEnd').timepicker({ showPeriod: true,
                      onHourShow: OnHourShowCallback,
                      onMinuteShow: OnMinuteShowCallback
                  });
                  function OnHourShowCallback(hour) {
                      if ((hour > 20) || (hour < 6)) {
                          return false; // not valid
                      }
                      return true; // valid
                  }
                  function OnMinuteShowCallback(hour, minute) {
                      if ((hour == 20) && (minute >= 30)) { return false; } // not valid
                      if ((hour == 6) && (minute < 30)) { return false; }   // not valid
                      return true;  // valid
                  }
                  $('#btnSearch').on('click', function () {
                      var sDate = $("#txtFromDate").val();
                      var sTime = $("#timeStart").val();

                      var eDate = $("#txtToDate").val();
                      var eTime = $("#timeEnd").val();

                      var startDate = new Date(sDate + " " + sTime).getHours();
                      var endDate = new Date(eDate + " " + eTime).getHours();

                      //Calulate the time difference
                      var hourDiff = endDate - startDate;
                      //alert(hourDiff);

                      //Check if hour difference is less than 4 hours and show the message accordingly
                      if (hourDiff < 4) {
                          var r = false; $($("<div>A mininum of 4 hours is required!</div>")).dialog({ closeOnEscape: false, resizable: false, modal: true, open: function (event, ui) { $(".ui-dialog-titlebar-close").hide(); }, buttons: { Close: function () { r = false; $(this).dialog("close"); } }, close: function () { return r; } });
                          return false;
                      }

                      //Add the check condition if the user is above the 4 hours time frame
                      if (hourDiff > 4) {
                          var r = confirm("There may be additional fees for going over the 4 hours!");
                          if (r == true) { // pressed OK
                              return true;
                          } else { // pressed Cancel
                              return false;
                          }
                      }
                  });
              });
</script>

This code worked a treat.

However, the users said that if a user goes over the allocated 4 hours, then they need to know how many hours are over 4 hours and multiply that by the set overage fee of $89.00.

So when a user clicks the link, to be redirected to ReserveFacility.aspx, the total overage hours and associated fees must be passed to that page as well.

As it stands right now, you can't see the link until you click the btnSearch button.

So, the calculation has to be done after the hyperlink is visible and I struggled with this for so long that I just remembered there is vb version and that's the one I posted above.

If I can resolve the issue of ValidateDuration is undefined error that happens when I use it below:

PHP

<asp:CustomValidator ID="CustomValidator1" runat="server"
ControlToValidate="endHour"
ErrorMessage="A minimum of four hours is required."
Text="*"
SetFocusOnError="True"
OnServerValidate="ValidateDuration"
ClientValidationFunction="ValidateDuration" />

then I will be glad to stay with the vb instead of the js. The js seems overly complicated for me.

Richard Deeming2-Mar-15 1:43

2-Mar-15 1:43

samflex wrote:
If I can resolve the issue of ValidateDuration is undefined error that happens when I use it below:

That sounds like a script error to me.

Don't forget that Javascript is case-sensitive - if you copied the code from my post in July, the ClientValidationFunction needs to be "validateDuration", with a lower-case "v".

samflex wrote:
So when a user clicks the link, to be redirected to ReserveFacility.aspx, the total overage hours and associated fees must be passed to that page as well.

Won't you also need to pass the start and end dates/times to the ReserveFacility.aspx page?

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

samflex2-Mar-15 4:04

2-Mar-15 4:04

At this point, no requirements for passing the start and end dates.

However, if that changes, it will be pretty easy to pass them to ReserveFacility.aspx page.

I can pass them as form fields as opposed to hourDiff which is a javascript variable.

Richard Deeming2-Mar-15 7:10

2-Mar-15 7:10

But if you can pass the start and end dates/times as form fields, then you could re-calculate the hourDiff on the server side. Smile | :)

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

samflex2-Mar-15 14:55

JSON Hijacking and ASP.Net MVC

2-Mar-15 14:55

Great idea!
Thank you sir.

Tridip Bhattacharjee27-Feb-15 1:55

Tridip Bhattacharjee

27-Feb-15 1:55

CSS

i was reading article on web security from this url http://haacked.com/archive/2009/06/25/json-hijacking.aspx/

the person so if any action method return data in json format for get request then malicious user can do CSRF. he suggested if stop delivering json data for get request then bad people can not hijack our json.

my question is if hacker drop a jquery script which make a ajax post request then also json will be delivered to client. so please tell me after reading that article that what the person is trying to say like deliver json for post request that will be invulnerable. because auth cookie goes at the time of get & post method too. help me to understand how to stop JSON Hijacking and also why author is saying post is secure than get?

tbhattacharjee

Re: JSON Hijacking and ASP.Net MVC

Richard MacCutchan27-Feb-15 3:00

Richard MacCutchan

27-Feb-15 3:00

Please read http://www.codeproject.com/Messages/1278599/How-to-get-an-answer-to-your-question.aspx[^] - again. If you have an issue with a magazine article or something posted on the internet then you should contact the author for clarification. I notice that the article in question is nearly six years old, so it is quite likely that the issue has been resolved since then.

Web site various attack and security

Tridip Bhattacharjee26-Feb-15 23:55

Tridip Bhattacharjee

26-Feb-15 23:55

i search google for my above question but not getting a single web site which will discuss all common and dangerous attach happen for web site and how to secure them. most of site is talking about XSS attach , CSRF & sql injection but i love to know other attack name as a result i can read and understand about those attack and solution to close those hole for a web site.

so if anyone knows any website address then please share the link which discuss about various attack and their solution.

tbhattacharjee

Re: Web site various attack and security

Richard Deeming27-Feb-15 1:26