|
You should NEVER rely on javascript for anything. You CANNOT disable it. Anything that is selected via javascript, MUST be validated on the server side before performing any actions.
Christian Graus - Microsoft MVP - C++
Metal Musings - Rex and my new metal blog
"I am working on a project that will convert a FORTRAN code to corresponding C++ code.I am not aware of FORTRAN syntax" ( spotted in the C++/CLI forum )
|
|
|
|
|
Christian Graus wrote: You CANNOT disable it. Anything that is selected via javascript, MUST be validated on the server side before performing any actions.
Then what will be the use of javascript if we are rechecking everything in server before processing ? Or is it possible to identify javascript is supported by the browser or not ? If not supported then validate it on server. What do you say ? Please make me clear
|
|
|
|
|
Navaneeth. wrote: Or is it possible to identify javascript is supported by the browser or not ? If not supported then validate it on server
Thats not the point that was made. The point is that the client (and any javascript methods) cannot be trusted. As was the original question, a user with some javascript know-how can manipulate the form.
The point of javascript is to make things easier for the user, like disabling the check boxes so its obvious they can't use them, rather than waiting for a postback only to be told they did something wrong. Javascript should be used to enhance the users experience of an site/application, but should never be relied upon for security.
|
|
|
|
|
I tend to check data at every boundary of the application.
I check that what the user put into my page is good.
I then check that what the page submitted to ASP.Net is good.
my ASP code then uses my Business Logic Layer which checks that the data it receives is good.
I don't specifically check that the data entering the database is good but i do have rigorous constraints set up on all databases and I make sure that only objects written by my team have direct writeable access to the DB. I also know that those objects have been repeatedly unit tested before they are released.
You can never check data enough in my opinion especially if those data may have been submitted by an external actor beyond your control. eg web user, public webservice, contract developer. This approach may be bordering on the paranoid but it makes applications far more stable especially as the type of checking that occurs at each level is likely to be different and therefore catches a different set of errors that may occur.
Russ
|
|
|
|
|
Hey people, I think you didn't understand me
I have a button - for example - on my web form
In some cases I disable this button by server side code, no problem
Now my question is:
Can any user openning this page execute javascript code from browser's address bar to enable that button??
And if yes, how can I prevent user from doing that??
|
|
|
|
|
We understood you perfectly.
Ahmad Safwat wrote: Can any user openning this page execute javascript code from browser's address bar to enable that button??
Yes.
Ahmad Safwat wrote: And if yes, how can I prevent user from doing that??
You can't, which is the point we were trying to make.
Go ahead and disable the button, but don't make that the only means to stop users doing whatever function is attached to it in the code-behind. You could always set its Visible property instead so it won't even be rendered to the client.
|
|
|
|
|
hi badgrs,
thanx my dear, I already hide controls instead of disabling them, but I thought there may be a better solution that I don't know
I don't want to check user's javascript code, I need to block scripting
I need to prevent users from run any javascript code on my page
Is this possible
because hiding controls sometimes make the page looks bad 
thanx again
|
|
|
|
|
Ahmad Safwat wrote: I need to prevent users from run any javascript code on my page
Is this possible
No.
|
|
|
|
|
|
Ahmad Safwat wrote: thanx my dear
Hmm, thats usually a phrase my ganny says to me...
Let me elaborate a bit, no isn't a very explanatory answer:
Ultimately you have no control what-so-ever over the browser. You can (and should) do everything possible to make things easier for the user, but you should never try to stop them doing anything. If they want to screw things up thats their problem, let them do it, just make sure you have sufficient validation in place server-side.
|
|
|
|
|
Hmmmm, thanx my dear 
This is really a good advice
thank u
|
|
|
|
|
HI i m using a simple web part application
But when i run that application it show me sqlserver 2005 error
the error is :
An error occurred during the execution of the SQL file 'InstallMembership.sql'. The SQL error number is -2 and the SqlException message is: Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding
I am not doing any database maniputation in my page still it show this error.
Any idea please tell me
Thanks in Advance
|
|
|
|
|
|
Prakash_Mishra wrote: Prakash Mishra(Banglore,India)
Prakash Mishra(Banglore,India)
One is Enough.
Regards,
Satips. ![Rose | [Rose]](https://www.codeproject.com/script/Forums/Images/rose.gif)
|
|
|
|
|
Hello
What is the use of repeating the same question rather than explaining it in a simple way ? I think including me no one understood what is your problem exactly. So please make it clear to get help.
|
|
|
|
|
i am doing an web page application in which i want to populate all the row data
values of the colum or row clicked by user...
As there is no mouseover or mouse click event for GridView in ASP .net wat can i do ....
Please Help......
Thanks
SAJAN A PILLAI
C#.NET Programmer
TELESOFT INDIA PVT LTD...
BANGALORE
|
|
|
|
|
1. You can use DataGrid's ItemDataBound event for this.
At any point you can have the exact cell value by --> e.Item.Cells[x].Text
--------------------------------------------------------------
2. You can also have mouseover or mouse-click events for a DataGrid Row.
if (e.Item.ItemType == ListItemType.Item ||e.Item.ItemType == ListItemType.AlternatingItem)
{
if (e.Item.ItemType == ListItemType.Item)
{
e.Item.Attributes.Add("onmouseover", "JavaScriptFunctionName();");
e.Item.Attributes.Add("onmouseout", "JavaScriptFunctionName();");
}
if (e.Item.ItemType == ListItemType.AlternatingItem)
{
e.Item.Attributes.Add("onmouseover", "JavaScriptFunctionName();");
e.Item.Attributes.Add("onmouseout", "JavaScriptFunctionName();");
}
}
|
|
|
|
|
i want to know how it can be done in gridview control
SAJAN A PILLAI
C#.NET Programmer
TELESOFT INDIA PVT LTD...
BANGALORE
|
|
|
|
|
hello,
i am trying to find out "how to add a simple textbox to a form at runtime and then send its textvalue(whatever written in it) to a datatable made in my dadabase"
is anybody can help me!
thanx in advance!
nitin
|
|
|
|
|
Add a placeholder control where you want to add the textbox
then at run time create the new object of your textbox give it id and then
add that textbox to the placeholder .
now the control is in page you can use that value
Thanks and Regards
Sandeep
If If you look at what you do not have in life, you don't have anything,
If you look at what you have in life, you have everything... "
|
|
|
|
|
Nitin, sandip is right...
However, you can also use "Panels" for the same
protected System.Web.UI.WebControls.Panel Panel1;
... ...
.... ....
TextBox txt =new TextBox();
txt.ID = "textBox1";
Panel1.Controls.Add(txt);
... ...
.... ....
//At any point of time you can read value from this text box
TextBox tempText = new TextBox()
tempText = (TextBox)Panel1.FindControl("textBox1")
string strValue = tempText.Text()
Sreekumar P P
|
|
|
|
|
thanx sir ji,
your view is very helpful 4 me but there is a prblm now...
i put 2 btn on form
btn1.text= add button
btn2.text= insert
when i click btn1 , a textbox appeared on forn but when i click btn2 the textbox disappear and nothing inserted in my database.
nitin
|
|
|
|
|
Any one knows what is Web 1.0 and Web 2.0 ?
|
|
|
|
|
Web 1.0 was about reading, Web 2.0 is about writing
Web 1.0 was about companies, Web 2.0 is about communities
Web 1.0 was about client-server, Web 2.0 is about peer to peer
Web 1.0 was about HTML, Web 2.0 is about XML
Web 1.0 was about home pages, Web 2.0 is about blogs
Web 1.0 was about portals, Web 2.0 is about RSS
Web 1.0 was about taxonomy, Web 2.0 is about tags
Web 1.0 was about wires, Web 2.0 is about wireless
Web 1.0 was about owning, Web 2.0 is about sharing
Web 1.0 was about IPOs, Web 2.0 is about trade sales
Web 1.0 was about Netscape, Web 2.0 is about Google
Web 1.0 was about web forms, Web 2.0 is about web applications
Web 1.0 was about screen scraping, Web 2.0 is about APIs
Web 1.0 was about dialup, Web 2.0 is about broadband
Web 1.0 was about hardware costs, Web 2.0 is about bandwidth costs
Regards,
Satips.
|
|
|
|
|
Hi Sathish Did you get it from any souce you have type it 
Thanks and Regards
Sandeep
If If you look at what you do not have in life, you don't have anything,
If you look at what you have in life, you have everything... "
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
