Tweet
If you work a lot with ASP and SQL, you might already know about SQL injections.
It's quite clear that every time we offer a visitor the possibility of filling a form (whatever its purpose may be), there's a security risk for our database. Basically, an attacker can insert some code in a form element, which will serve as a breach, allowing access to data stored in the database.
How that's done is not the main topic of this short post, however we should be aware of the fact that those threats are often used to update, delete and insert data, or in worst cases, they are used in order to gain access to reserved areas of a web site.
In this article, we are going to create a small VBScript function to avoid SQL injections.
Web development, web design and programming.
Showing posts with label replace. Show all posts
Showing posts with label replace. Show all posts
Friday, 4 May 2012
Wednesday, 28 December 2011
ASP: simple CAPTCHA method
Tweet
I'm sure you know what CAPTCHAs are. They usually are not very welcomed when filling in a form, but the idea behind them is to at least reduce the possibility of automatic non-human procedures submitting the form itself. The main point is to recognise if who or what is submitting a request is really a human or not.
The solution I'm presenting here is very simple and it is not unbreakable. Infact, today we surely need a highly sophisticated CAPTCHA procedure in order to be completely sure of its effectiveness.
On the other hand, we can use the solution here presented whenever we need a little bit more security.
We are going to use ASP and GUIDs (Globally Unique Identifier).
Follow me, please.
I'm sure you know what CAPTCHAs are. They usually are not very welcomed when filling in a form, but the idea behind them is to at least reduce the possibility of automatic non-human procedures submitting the form itself. The main point is to recognise if who or what is submitting a request is really a human or not.
The solution I'm presenting here is very simple and it is not unbreakable. Infact, today we surely need a highly sophisticated CAPTCHA procedure in order to be completely sure of its effectiveness.
On the other hand, we can use the solution here presented whenever we need a little bit more security.
We are going to use ASP and GUIDs (Globally Unique Identifier).
Follow me, please.
Monday, 14 February 2011
SQL Server: apostrophes in queries
Tweet
Apostrophes ( ' ) in queries might be a big problem. In fact, we usually build our queries without thinking about it, maybe because it's quite unusual to have data containing such strange characters. That leads to difficulties in isolating the cause of an error while executing a query statement, especially when the query worked for a year and then - suddenly - starts giving problems. It is quite common not to think about new data recently entered or updated, and usually we concentrate on the query statement and thus - let me say - waste a lot of time/money.
Apostrophes ( ' ) in queries might be a big problem. In fact, we usually build our queries without thinking about it, maybe because it's quite unusual to have data containing such strange characters. That leads to difficulties in isolating the cause of an error while executing a query statement, especially when the query worked for a year and then - suddenly - starts giving problems. It is quite common not to think about new data recently entered or updated, and usually we concentrate on the query statement and thus - let me say - waste a lot of time/money.
Subscribe to:
Posts (Atom)