ASP.NET

Pankaj Garg10-Jun-08 2:04

10-Jun-08 2:04

in the address
www.abc.com/id=1
i don't want to display id=1
in the address bar.
this leads to database hacking.
Can i do it?

If you have an apple & I have an apple and we exchange our apples, then each of us will still have only one apple but if you have an idea & I have an idea and we exchange our ideas, then each of us will have two ideas!

Ashfield10-Jun-08 2:24

Ashfield

10-Jun-08 2:24

Pankaj Garg wrote:
www.abc.com/id=1
i don't want to display id=1
in the address bar.
this leads to database hacking

Not if you are using stored procs because:

1) www.abc.com?ggsttfgj=1 would be pretty meaningless, but your code knows that ggsttfgj is really the id

2) all you are passing is a stored proc parameter. Nobody has any idea what stored proc is going to be called

Can you hack this to get into a database?

http://www.codeproject.com/script/Forums/Edit.aspx?fid=12076&select=2590541&floc=/script/Forums/View.aspx&fa=r

Its all about relative security, and if you are not using stored procs or parametrised queries then you may as well use plain text as you are open to sql injection anyway.

Bob
Ashfield Consultants Ltd

Christian Graus10-Jun-08 3:38

Christian Graus

10-Jun-08 3:38

Pankaj Garg wrote:
i don't want to display id=1
in the address bar.

You can't avoid that unless you use cross page postbacks. But, it doesn't lead to hacking, the worst it leads to is someone wandering your DB. you should have permission layers so even if someone uses the id of another user, they won't get to the data. If you build it right, there's no reason to worry about ids on the URL, and having them there has a lot of benefits ( such as bookmarkable pages )

Christian Graus

Please read this if you don't understand the answer I've given you

"also I don't think "TranslateOneToTwoBillion OneHundredAndFortySevenMillion FourHundredAndEightyThreeThousand SixHundredAndFortySeven()" is a very good choice for a function name" - SpacixOne ( offering help to someone who really needed it ) ( spaces added for the benefit of people running at < 1280x1024 )

N a v a n e e t h10-Jun-08 2:00

10-Jun-08 2:00

By validating querystring values. Alternatively, you can encrypt the querystring values.

All C# applications should call Application.Quit(); in the beginning to avoid any .NET problems.- Unclyclopedia

How to use google | Ask smart questions

Pankaj Garg10-Jun-08 2:10

10-Jun-08 2:10

u have any link regarding the same?

N a v a n e e t h10-Jun-08 2:25

10-Jun-08 2:25

I don't have. Validating query string values are pretty easy. Before processing make sure the values you got from querystring is valid. To prevent SQL Injection, you need to use parameterized queries instead of appending query in a string.

All C# applications should call Application.Quit(); in the beginning to avoid any .NET problems.- Unclyclopedia

How to use google | Ask smart questions

eyeseetee10-Jun-08 2:16

10-Jun-08 2:16

Put your variable in a session

We are not a Code Charity

Pankaj Garg10-Jun-08 2:18

10-Jun-08 2:18

is there any way to change the page name like
www.abc.aspx/id=2
to
www.abc.aspx/2
something like this.

eyeseetee10-Jun-08 2:25

10-Jun-08 2:25

OK, I dont think you are totally understanding what you are doing.
You just edit the URL that you are going to in the http link or where ever it is you click and navigate from one page to another.
Store the variable id in a session instead then you can just have your URL as www.abc.co.uk/Page.aspx

We are not a Code Charity

Ashfield10-Jun-08 2:28

Ashfield

10-Jun-08 2:28

Pankaj Garg wrote:
is there any way to change the page name like
www.abc.aspx/id=2
to
www.abc.aspx/2

No, but its your code so you could do www.abc.aspx?2 - waht ever you want to put after the ? is up to you and your app, nothing else cares (well within reason)

Bob
Ashfield Consultants Ltd

meeram39510-Jun-08 2:29

10-Jun-08 2:29

Just check on this url : http://steveorr.net/articles/PassData.aspx . It contains all the ways to pass values between pages and discusses which are all secure methods.

Meeram395

N a v a n e e t h10-Jun-08 2:27

10-Jun-08 2:27

.netman wrote:
Put your variable in a session

Not recommended until the data you are passing is sensitive. If it is not, a query string validation will do.

All C# applications should call Application.Quit(); in the beginning to avoid any .NET problems.- Unclyclopedia

How to use google | Ask smart questions

eyeseetee10-Jun-08 2:32

10-Jun-08 2:32

The problem with query string is passing it from page to page

We are not a Code Charity

N a v a n e e t h10-Jun-08 3:14

sorting gridview in asp.net 2.0

10-Jun-08 3:14

If it is handled properly, it's the most efficient and simple method to pass value from page to page.

All C# applications should call Application.Quit(); in the beginning to avoid any .NET problems.- Unclyclopedia

How to use google | Ask smart questions

vijaylumar10-Jun-08 0:39

vijaylumar

10-Jun-08 0:39

hai friends

i want to programatically sort gridview colums
i manually filling the gridview with code

and i have a 3 buttons with text 'column1' , 'column2' , 'column3'

if i click on button 'column1' then gridview should be sorted basing on 'column1'

plz help me...

its urgent ....

thanks in advance
vijay

Re: sorting gridview in asp.net 2.0

meeram39510-Jun-08 0:44

is there any method to create report

10-Jun-08 0:44

Check here

Meeram395

deepthy.p.m10-Jun-08 0:05

deepthy.p.m

10-Jun-08 0:05

In asp.net i want to create report other than crystal report because.When i host to sever crystal report is not working. So any other method

Re: is there any method to create report

eyeseetee10-Jun-08 0:21

How to validate a textbox value with xsd

10-Jun-08 0:21

Try Microsoft Report Viewer

http://www.codeproject.com/KB/webforms/ReportViewer.aspx

We are not a Code Charity

Rohit16db9-Jun-08 23:13

Rohit16db

9-Jun-08 23:13

Hi,

I have a XSD having too many element specified. I want to validate my textbox value with a specified element only.

Can anybody suggest me how to do this thing?

Thanks

problem with connection string

eyeseetee9-Jun-08 23:00

9-Jun-08 23:00

Hi
I declared a connection string in my page_load event.
So ive got this:

string connectionString;
SqlConnection con

connectionString = ConfigurationManager.ConnectionStrings[project].ConnectionString;
con = new SqlConnection(connectionString);

Now when I try and reference con.open(); in a different event e.g. onclick it doesnt work.
However when i delclare:

string connectionString2 = ConfigurationManager.ConnectionStrings[project].ConnectionString;
SqlConnection con2 = new SqlConnection(connectionString2);

in the onclick event it works. If you declare in page_load does it not work in a different event?
any help would be great!
cheers

We are not a Code Charity

Pankaj Garg9-Jun-08 23:09

9-Jun-08 23:09

i think after postback , it initiates the variable form the scratch

eyeseetee9-Jun-08 23:28

9-Jun-08 23:28

So do I need to put the connection string in a postback check as well then?

We are not a Code Charity

meeram3959-Jun-08 23:45

9-Jun-08 23:45

HI,

Please try to put the Connection strings and variables outside the IsPostBack and check. It will work.

Meeram395

eyeseetee9-Jun-08 23:54

9-Jun-08 23:54

Ive tried that already.
I delcare the name connectionString and con at the top of the page.
I have then specufy connection string code in the page load.:

connectionString = ConfigurationManager.ConnectionStrings[project].ConnectionString;
con = new SqlConnection(connectionString);

However I cannot reference it once outside of the page_load say in an onclick event.
it recognises the con.open(); but doesnt perform the query.
There is no mistake with the query, it works fine.

Ive got the query in a try/catch/finally statement would this affect it?
Thanks for the help, really puzzling me.

We are not a Code Charity

meeram39510-Jun-08 0:04