|
Amer Amer wrote:
Dim sqlcom As New SqlCommand("select bookcontent,bookname from books where bookn=" & Page.RouteData.Values("bookn").ToString & "", conn)
Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.
Dim ds As New DataTable
Using sqlcom As New SqlCommand("select bookcontent,bookname from books where bookn = @bookn", conn)
sqlcom.Parameters.AddWithValue("@bookn", Page.RouteData.Values("bookn"))
Dim da As New SqlDataAdapter(sqlcom)
da.Fill(ds)
End Using
If ds.Rows.Count <> 0 Then
Dim filename As String = ds.Rows(0).Field(Of String)("bookcontent")
Dim fff As String = ds.Rows(0).Field(Of String)("bookname")
Dim fileInfo As FileInfo = New FileInfo(filename)
If fileInfo.Exists Then
Response.Clear()
Response.Cache.SetCacheability(HttpCacheability.NoCache)
Response.ContentType = "application/pdf"
Response.AddHeader("Content-Disposition", "inline; filename=""" & fff & ".pdf" & """")
Response.AddHeader("Content-Length", fileInfo.Length.ToString())
Response.TransmitFile(filename)
Response.Flush()
Context.ApplicationInstance.CompleteRequest()
Return
End If
End IfEverything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]
As already mentioned, this is the only way to send the file to the user. IIS is pretty good at handling file transfers; requests from other users shouldn't be blocked whilst the file is downloading.
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
thank for the support Its work, your code very useful and your advice is valuable.
modified 10-Jun-20 17:14pm.
|
|
|
|
|
I'm trying to decide here.
If I create an account on my Web App, using my email address me@mywebapp.com, and then later I'm offered the opportunity to login to my Web App using Google SignIn; because I just wrote the code to add this feature, and elected to use it.
A:
Should I use googleUser's email address (me@mywebapp.com) as the account name, because I want to create an account to represent the user. But id the email is in use already, just update the login, and use the googleUser token to authenticate again, to AuthGuard.
Pro's:
I can login using either method to the same account.
Con's:
I can't really think of any, which is why I'm asking. Am I over looking something, perhaps someone's experience can say ... "No don't do that because ...".
B:
Use googleUsers first and last name, and sort of create a new account name from it that is unique.
Pro's:
I can't think of any
Con's:
EBay did this to me, and I ended up with 2 EBay accounts; didn't realize it for months, and really wish I just had the one.
Sounds like a dumb question, but wanted to ask before going into production mode.
If it ain't broke don't fix it
Discover my world at jkirkerx.com
|
|
|
|
|
In the company intranet where I work there is a web-based documentation system that you can access through a regular web browser (Chrome, Firefox, Edge, etc). I need to write an application (in C#) that interfaces to this documentation system and I'm currently working on making sure that I can programmatically supply the user name and password correctly. When accessing the documentation system through a web browser, I always have to supply the user name and password once after re-boot and then I never have to type it again until next re-boot. I've come to the conclusion that the user name and password are being stored somewhere in the computer, but they are not stored in the browsers themselves and if I go to Control Panel -> User Accounts -> Credential Manager I see mostly Microsoft related passwords (Microsoft Outlook, Microsoft Office, XboxLive, SSO_POP_Device, virtualapp/didlogical, tfs, etc). Does anybody know where the user name and password could be stored and how I can remove them (without rebooting my computer) in order to be able to verify that my code supplies the user name and password correctly? I already asked the IT-manager (who's also in charge of the documentation system) and he didn't know.
|
|
|
|
|
Does it display a form within the site to enter the credentials, or does it pop up the "Windows authentication" dialog box?
If it's a form within the site, then the site is probably setting an authentication cookie. This won't contain the credentials (unless the site was written by someone who didn't know what they were doing!); instead, it will contain a signed and encrypted token which the server can use to identify the user. If you clear the cookies for the site, then you should be prompted to log in again.
If it's popping up the "Windows authentication" dialog box, then the browser will cache the credentials securely until it is closed. When you close and reopen the browser, you should be prompted to log in again.
For Internet Explorer, you can clear the Windows authentication cache without closing the browser by executing the (non-standard; deprecated) command:
document.execCommand("ClearAuthenticationCache", false);
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
Yes, it's Windows Authentication. Chrome and Interner Explorer are still running in the Ctrl+Alt+Delete task manager, even though all windows are closed so I guess that's why they remember the credentials. Thank you for solving this.
modified 19-May-20 15:25pm.
|
|
|
|
|
For Chrome, there's a setting you might need to change:
Settings ⇒ Advanced ⇒ System ⇒ Continue running background apps when Google Chrome is closed
If it's on, Chrome will continue running even if you close all windows.
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
I'm working on a filter for a Custom Post Type . I need it to filter the list depending on the user's role. The way this should work is the following...
- Users in roles "formusers1" and "formusers2" can post. Users can only see their own posts.
- Users in role "formchecker1" can see all posts assigned role "formusers1' and can approve each post.
- Users in role "formchecker2" can see all posts assigned role "formusers2' and can approve each post.
- Users in roles "formsupervisor" and "administrator" can see everyone's posts.
So far I can filter by roles "formusers1" and "formusers2" using:
$query->set('author', $current_user->ID); However, when try to filter the list for role "formchecker1" I see posts from all roles. What am I doing wrong? Here's the rest of the code. Thanks for checking out!
add_action('pre_get_posts', 'filter_posts_list');<br />
<br />
function filter_posts_list($query) {<br />
global $pagenow, $typenow;<br />
<br />
global $current_user;<br />
get_currentuserinfo();<br />
<br />
if (current_user_can('formchecker1') && ('edit.php' == $pagenow) && $typenow == 'mycustomcpt' ) {<br />
$query->set('author', 'formusers1');<br />
}<br />
<br />
if (current_user_can('formchecker2') && ('edit.php' == $pagenow) && $typenow == 'mycustomcpt' ) {<br />
$query->set('author', 'formusers2');<br />
}<br />
<br />
if ((current_user_can('formusers1') || current_user_can('formusers2')) && ('edit.php' == $pagenow) && $typenow == 'mycustomcpt') {<br />
$query->set('author', $current_user->ID);<br />
}<br />
}
|
|
|
|
|
You need to show the code that decides whether a post can be shown or not. I am assuming that the above code has been tested and sets the correct values.
|
|
|
|
|
Hello All,
Sorry if this is the incorrect area to post question, but how do i set a timer in powershell script, so that when the authentication expires, to reset it again?
Many thanks!!
|
|
|
|
|
I'll be creating an Asp.Net Web API for a construction management app I'm working on. I'v created API's before, and I usually create one controller for each functional area. So, for Projects I have a ProjectController, for Jobs there's a JobController, Employees has an EmployeeController. In eah controller I place methods that access the DAL for everything related to that functional area.
Is this the right approach? I'm open to suggestion.
If it's not broken, fix it until it is.
Everything makes sense in someone's mind.
Ya can't fix stupid.
|
|
|
|
|
how to creat website page
|
|
|
|
|
We really can't tell you - it's far, far too big a question for a little text box!
For starters, there is the language(s) you need to choose: HTML and Javascript are pretty much a given, but for any real interaction you will need a back end language as well: C#, VB, PHP, Ruby, Python ... to name just a few. Then there are front end packages: Node.js, Angular, ... the list goes on.
And next databases ... SQL Server, MySql are the most common, but there are others.
Then, hosting: where are you going to put it? You need a domain or people can't get to it, and that normally means a hosting service - so then you have to find out what they provide, and estimate how much resources you will need - and how much you are willing to pay for them!
Finally, there is the type of website you want to develop: a shop front, a blog store, a chat room, a game, an advertising hoarding, ... there are as many of them as there are websites, pretty much.
And all of this comes with a learning curve - while you can create a basic website with just HTML and a free hosting service it won't be at all interactive and so unlikely to attract any visitors.
To add to the fun, we have no idea of your skills, interests or abilities, and that really restricts what you can get up and running in a short time, and severely restricts any advice we could give you.
What I'd suggest is that you look at your current skill set and find a book (or better a course) which builds on on those skills and expands them in the direction you want to go. Addison Wesley, Wrox, and Microsoft Press all do good books on a huge range of web related projects so go have a look at their ranges and see what fits you abilities.
Good luck!
"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
Just write some html.
Social Media - A platform that makes it easier for the crazies to find each other.
Everyone is born right handed. Only the strongest overcome it.
Fight for left-handed rights and hand equality.
|
|
|
|
|
By begging or paying large sums. In your case, a very large sum, in advance.
Bastard Programmer from Hell 
If you can't read my code, try converting it here[^]
"If you just follow the bacon Eddy, wherever it leads you, then you won't have to think about politics." -- Some Bell.
|
|
|
|
|
Start HERE to learn HTML[^] - that's the most basic language of the web. Make a web page
Afterwards, move on to CSS (CSS3 these days) - teaches you how to format decorate the page
Then javaScript - gives life to your web page: so when a button is clicked, for example, it does something.
Finally, I prefer PHP. PHP will allow you to build pages uniquely for each user, access databases, move files. Make a real website!
The first three have interactive "try it" areas for you to see the code, modify it, and then see what happens.
| Ravings en masse^ |
|---|
| "The difference between genius and stupidity is that genius has its limits." - Albert Einstein | | "If you are searching for perfection in others, then you seek disappointment. If you seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010 |
|
|
|
|
|
making class in models.py , making migrations but giving errors as below
python: can't open file 'manage.py': [Errno 2] No such file or directory
|
|
|
|
|
Firstly, this has nothing to do with web development. Secondly, the error message could not be clearer.
|
|
|
|
|
Mohammad Shafique wrote: python: can't open file 'manage.py': [Errno 2] No such file or directory
You'll need to figure out where it went.
Social Media - A platform that makes it easier for the crazies to find each other.
Everyone is born right handed. Only the strongest overcome it.
Fight for left-handed rights and hand equality.
|
|
|
|
|
I am looking for some one that can crate School student_result_management
|
|
|
|
|
Wrong site, try freelancer.com or one of the other code to order sites. We will help you with a coding problem but we do not code to order.
Never underestimate the power of human stupidity -
RAH
I'm old. I know stuff - JSOP
|
|
|
|
|
Hello.
If you want solution, contact me.
|
|
|
|
|
hi!)
If you need help, and the question is still relevant and you need
Custom eLearning Solutions . I can help you with this question. Is there an SOW?
|
|
|
|
|
I have this CMS work, at the edit_subject page, I have some problem that say ( The subject update failed.
You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '} WHERE id = 1' at line 4)
This is the page
30);
foreach($fields_with_lengths as $fieldname => $maxlength ){
if (strlen(trim(mysql_prep($_POST[$fieldname]))) > $maxlength) { $errors[] = $fieldname; }
}
if (empty($errors)) {
// Perform Update
$id = mysql_prep($_GET['subj']);
$menu_name = mysql_prep($_POST['menu_name']);
$position = mysql_prep($_POST['position']);
$visible = mysql_prep($_POST['visible']);
$query = "UPDATE subjects SET
menu_name = '{$menu_name}',
position = {$position},
visible = {visible}
WHERE id = {$id}";
$result = mysql_query($query, $connection);
if (mysql_affected_rows() == 1) {
// Success
$message = "The subject was successfully updated.";
} else {
// Failed
$message = "The subject update failed. ";
$message .= "
". mysql_error();
}
} else{
// Errors occurred
$message = "There were " . count($errors) . " errors in the form. ";
}
}// end: if (isset($_POST['submit']))
?>
| Edit Subject:
" . $message . "";} ?>
";
echo "Please review the following fields;
";
foreach($errors as $errors) {
echo " - " . $errors . "
";
}
echo "";
}
?>
Subject name:
Position:
{$count}";
}
?>
Visible:
No
/> Yes
Cancel |
I need your help
|
|
|
|
|
Your post is quite poorly formatted, but it looks like you are missing a $ symbol where {visible} should be {$visible}.
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
