|
|
I have read that already, but it doesn't answer all my questions.
|
|
|
|
|
First, I should let you know that I never worked with Classic ASP and ADO, just the .NET variety, so if I make an incorrect assumption you can let me know.
If Classic ASP supports parameters on the command that it sends to the database then this will be okay because this separates the command from the data. So, if the data is dodgy it arrives at the stored procedure already wrapped as a parameter. If, however, the Stored Procedure is being called from ASP in the form EXEC sp_InsertTitle '[Value From Textbox goes here]' then you will have the potential for an attack to occur.
The part you should watch out for is the possibility of Second Order Injection Attacks. This means that the initial data is input into the data and it sits there quietly not doing anything. Then at some later point the column value is used to dynamically generate some SQL command. If you are doing that then there is a possibility of an attack at that point. This is actually harder to track down because the attack occurs but the payload does no damage until sometime later.
Does this help?
My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More
|
|
|
|
|
Hi there,
I am struggling with a piece ofcode. I am using using classic ASP (which is the normal ASP,and not ASP.NET). I am using SQL Server 2000 as the database. I am using stored procedures.
I am using the command object when adding data to the database. My code looks like this:
objCmd.Parameters.Append objCmd.CreateParameter("@ContactCommQues", adWChar,
adParamInput, 16, Request.Form("txtQuesComments"))
txtQuesComments is a input control. The value 16 in the CreateParameter method I took because when you define a field with the ntext datatype, it automatically inserts a 16 for the size of that field. OK, coming back to the CreateParameter method, the value 16 represents the size, and the MSDN library defines this field as "A Long value that specifies the
maximum length for the parameter value in characters or bytes". Now the problem is that I do not know what the length of the <textarea> will be, it might be a long letter or article, maybe it can be 10000 characters long. Do you know how I can solve this? What I thought wasmaybe I should replace value 16 with something like Len(Request.Form("txtQuesComments")). This seems to work, but is this the only way?
Here is a shortened version of my stored procedure:
CREATE Procedure sp_InsertContact
(
@ContactCommQues ntext
)
AS
INSERT INTO tblContact
(
ContactCommQues
)
VALUES
(
@ContactCommQues
)
GO
Thanks
|
|
|
|
|
Hi there,
I have a problem with my regular expression functions. The thing is that it accepts alpha characters and numeric characters where I only want it to accept alpha characters from a thru z, and A thru Z. So Brendan would be valid, and Brendan1 would be invalid.
My test function in my .js file
function isOnlyAlpha(strString)
{
var re = /[a-z]/i;
var isValid = re.test(strString);
return isValid;
}
And my calling function from my .asp page
if(!isOnlyAlpha(form.txtFName.value))
{
alert('Valid first name required!');
form.txtFName.focus();
return false;
}
My regular expression looks right to me! What do you think.
Brendan
|
|
|
|
|
You are testing to see if *any* of the characters is alpha - not to see if *all* of the characters is alpha.
Try
var re = /[0-9]*/;
|
|
|
|
|
I have form with the follows parameters :
I want to address to the form element from JavaScript :
document.form.var[1].checked=true;
But in this case i retrieve an error :
document.form.var.1 is not an object !
HOW COULD I REFER to the FORM's ELEMENTS ?
|
|
|
|
|
you have used this...
document.form.var[1].checked
write form name instead of just form
i.e
say you have .....
then write as
document.myform.var[1].checked
try this...
Abhijeet Jadhav
|
|
|
|
|
Hello
Does anybody know some JavaScript/HTML component, which behave like a programming text editor ? What i mean is to provide syntax coloring for JScript/VBScript languages on the web page, and let the user to write scripts online, like in IDE. Surely TEXTAREA would be enough, but i'd like to make it a bit fancy.
|
|
|
|
|
First off let me say i am NOT a javascript developer i SUCK at it i only scrape by when i absolutely need to use a client side script. not to say i can't write a script that works i'm just bashing my head off the monitors trying to figure out how to do this.
basically i wrote a quick little javascript for my girlfriend's personal website that uses the onMouseOver event to show and enlarged picture and a description of said picture when the mouse is moved over a thumbnail
the script function is simply passed the ID of the thumbnail and it uses the GetElementByID and the GetAttribute and SetAttribute to change the Large Display Picture and the textbox input field.
this all works beautifully
now for the problem 
we have 4 cats and one overly used digital camera so there's a ton of pics on her site now her page is in frames and when the picture page loads you have to scroll to the bottom to see all the thumbnails which scroll the large display picture right out of view... this kindof defeats the purpose of the script now me being an ASP.NET fan would just throw in two panels set some attributes and i'd be done.
but her webserver doesn't support ASP.NET 
so i decided to split the page into two horizontially split frames the large pic and textbox in the top frame and the thumbnails in the bottom frame. now the problem is my script won't work and i have been searching everywhere on the web to find out how to access elements of one frame from another frame.
i left the script in the frame with the thumbnails since they are the ones that reference the function.
i just need to know how do i reach the large picture and the textbox elements in the other frame and change their attributes.
Sorry for the ramblin my brain is fried 
Ryan
|
|
|
|
|
Hello,
can any body tell me solution for following.
What should I do so that google search engine
searches and display my web site in search result.
right now its searches by company name and by some
of word in web page but its not able to search every important word on page.
For that I have to do only URL registration or every individual key word registration for which I want to
redirect to particular page? and how it will be done?
Its require chane in coding or only registration to search engine will do?
I heve try some of sites but its not working.
regards
Khyati
regards
khyati
|
|
|
|
|
Khyati Asher wrote:
What should I do so that google search engine
searches and display my web site in search result.
Use Google AdWords[^]
|
|
|
|
|
Dear CPians,
I am trying to make a regular expression to be used in ASP (VB Script).
I need to search for a specific TAG within an HTML file. I want the regullar expression to provide me with the TAG as one MATCH and all its attribute names and value pairs in SUBMATCHES.
For example if the following TAG existed in an HTML file, my regular expresion should return the tag as it is.
<SPAN id="spanId" onclick="doSomething();">my span</SPAN>
and then I would like to get the atribute pairs as such:
id
spanId
onclick
dosomething
So far I have come up with this pattern:
<SPAN\s*(((\w+)=(.*?))*)?>(?:.*?)</SPAN>
The pattern above would return
the tag as it is in the HTML file.
then all the attributes together as such:
id="spanId" onclick="doSomething();"
and then it will return only the last attribute name-value pair.
onclick
dosomething
discarding the first one (id,spanId)
Any ideas?
theJazzyBrain
Excellence is not an act, but a habit! Aristotle
|
|
|
|
|
Hi there, I am trying to create an Order form but am having problems.
The Form has two submit buttons.
One submit button is for previewing and the other is to basically continue. I can succesfully allow users to click either submit button to be forwarded to the corresponding page but what I cant seem to do is create alert boxes that STOP the user from submitting any of the submit buttons if some fields have not been filled out.
My code has the alert functions applied to each field and an alert box does show if a field is missing but it also loads the correspondin page, which I dont want it to.
Any help would be greatly appreciated.
Thanks
|
|
|
|
|
Don't create two submit button. If you want to do something when the button is pressed, it is better to do it from javascript code. You better use the usual button.
<italic>Work hard, Work effectively.
|
|
|
|
|
Thanks for your response, but Im not sure that I am getting what I need help for across properly.
Basically this is what my page looks like.
example:
Enter Name: (Textbox is here) - Required Field
Enter Template: (Drop down list is here) - Required Field
(Preview Submit Button is Here) (Continue Submit button is here)
-----
now all I need to know is how do I add alerts that stop the user from succesfully loading the preview or continue page if the required fields are not filled?
or another way of describing what I am trying to do is, how do I disable both submit buttons if all required fields are not filled.
|
|
|
|
|
Enter Name: (Textbox is here) - Required Field
Enter Template: (Drop down list is here) - Required Field
(Preview Button is Here) (Continue button is here)
Use the usual button.
When the preview button is click<br />
{<br />
validate , alert if not filled<br />
preview if all field are filled<br />
}<br />
<br />
when the submit button is click<br />
{<br />
validate , alert if not filled <br />
submit form if all field are filled<br />
}
<italic>Work hard, Work effectively.
|
|
|
|
|
I figured out what it was,
this is the code that was in my header (also have alerts):
and I just removed the :
document.Form1.submit(); // Submit the page
My alert boxes worked for both submit buttons.
|
|
|
|
|
Good for you. BTW is that your real name?
<italic>Work hard, Work effectively.
|
|
|
|
|
Yes it is my real name....
hehe just kidding.
Im a fan of ange.;)
|
|
|
|
|
|
Who knows. It might be her.
<italic>Work hard, Work effectively.
|
|
|
|
|
I have the following function and I would like to size the new window to the correct dimensions of the picture filename sent. How can determine the size of the picture at the time the function is called ?
Thanks.
function doWindow(filename)
{
winB = window.open("","","height=600, width=800,scrollbars=yes")
winB.document.location.href=filename;
}
|
|
|
|
|
You can point to the image in your popup window and get the size from there and then resize the popup to the new height and width variables.
picHeight=winB.document.imagename.height
picWidth=winB.document.imagename.width
winB.height=picHeight
winB.width=picWidth
I'm not positive on those last two lines, but there are attributes that will do that type of thing.
|
|
|
|
|
i am a student i need to develope a flash game in four days, what should i do? need some good sites and tutorials or should i trying decompling a game and understanding it from finish????
need urgent help thanks
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
