|
Hi
In asp.net website when writting inside textboxes html tags or single cote an error is generated " potentially dangerous Request.Form value was detected from the client ".
I used to put in page directive of master page validaterequest=false and everything is ok.
I have met someone who told me that this is not secure and can cause sql injection (but iam using stored procedures) or script injection.
I have also read about enabling "Debug=true" directive at the top of the file that generated the error
I also know that we can encode our text values and save them in sql as encoded using Server.HtmlEncode(txtName.Text));
but do i have in this case to write Server.HtmlEncode and decode when reading for every textbox i have and does it have any influence on loading time, does it take time????
plz advice and thanks
|
|
|
|
|
first thing using validaterequest=false is not secure is right. It may cause of script injection but sql injection can be used. Server.HtmlEncode will protect you for script injection. about the loading time you can check your self as:
add:
<system.web>
<trace> enabled="true"
mostRecent="true"
requestLimit="50" />
In your web.config file and...
Then open trace.axd file by write in end of your url like:
http://www.codeproject.com/script/Forums/Edit.aspx/trace.axd
Gaurav Kumar Singh
Consultant (Asp.net)
|
|
|
|
|
Actually my problem is:
there are two usercontrol uc1 and uc2 in uc1 there is a input hidden value which i want to access in uc2
can anyone tell how to access that...
I tried with Page.FindControl, Master.FindControl, Master.Master.FindControl but nothing seems to work.... all gives null references.... values is null...
Any suggestions is most appreciated......
Please if have any idea do get me posted as early as possible!!
Paritosh Tripathi
B.Tech. (C.S.)
BrainTechnosys Ltd.
modified on Thursday, April 23, 2009 7:01 AM
|
|
|
|
|
Hi Paritosh,
The link below may provide solution for your problem.
http://www.dotnetfunda.com/articles/article201.aspx
This worked fine for me.
Regards,
Nyoti
|
|
|
|
|
Hi Nyoti
Thanks for your reply
But actually i didn't specified that my page is a dynamic page which is created at runtime and now i want to access a usercontrol's hidden input in other usercontrol.
SO the main problem is that page in which the usercontrols are show is dynamic and usercontrols are also dynamically loaded onto the page.
Paritosh Tripathi
B.Tech. (C.S.)
|
|
|
|
|
OK.
In this case, you can add dynamic events at the time of Control Creation and write handlers for them.
|
|
|
|
|
Can elaborate it a bit.....
coz i've not done this kinda task before so ifu could explain it with any example would be of grr8 help...
Paritosh Tripathi
B.Tech. (C.S.)
|
|
|
|
|
ok. Are you able to execute the events in your user controls?
If not, then you need to do something like this.
EventInfo SomeEvent = AnyControlInYourUserControl.GetType ().GetEvent("Click");
SomeEvent .AddEventHandler(AnyControlInYourUserControl, new EventHandler( this.AnyControlInYourUserControl_Click));
Write a handler for this.
But I think, you are already executing postback, however, since the page is dynamically being created, on post back you are loosing the value of the hidden variable. So in the event handler function above you can store the value of the variable in the session and then can access it.
I am sorry, if I misunderstood anything. I will post the code tonight if you want.
Thanks,
Nyoti
|
|
|
|
|
Hi Nyoti,
No no you've been of grr8 help but actually i'm not able to get the usercontrol
i mean the page is dynamic and controls in it are dynamic.
Ok i'll explain it ..
I've a dynamic page which has a 2 panels in each panel there are usercontrols 1 control shows the articles and other has a review
for every article user can post review and that review details are stored in database now problem is when i'm saving the details i need the article id so that i can link the reviews with the articles. i've already taken a input hidden value in which i'm storing articleid in codebehind
now i want that article id in the review usercontrol so on submit button click i can save the article id (uniquidentifier) into database along with review details.
Hope now you can get exactly what i'm trying to do...
Now i want the usercontrol id so i can findcontrol inside it and can find the htmlinputhidden value..
thanks in advance.
I'm sure you'll be ready with solution to this problem.
Sorry to trouble you so much but really stuck with this problem so favour needed.
Paritosh Tripathi
B.Tech. (C.S.)
|
|
|
|
|
Dear All,
I need some advise how to make a website like SCRIBD or Google Books, what tools I need.
Thanks
|
|
|
|
|
I suspect from your question this project is doomed. If you don't even know what tools you need then how do you expect to have the knowledge to use them in a complex project?
Aim lower to start with, then build up to more complicated things.
Bob
Ashfield Consultants Ltd
Proud to be a 2009 Code Project MVP
|
|
|
|
|
Good day!
I read several acticles about getting the "users online count" and "registered users count". However most of them were not full or lack performance. So i decided to make my own logic and i would like to share it with you. Can you please comment on it ? Is my logic wrong ?
Get registered users count:
DB logic:
- Store the count in a special table on the SQL server as a parameter. Increment the count when a new user is created. Decrement count when user is deleted ( or expired ). There is an alternative to SELECT COUNT(*) FROM Users...... but i discarded it. I don't think it's the best way to achieve my goal.
Get online users count:
DB logic:
- Store session information in a special table on the SQL server. Update the table whenever an activity is idicated ( the important here is the LastActiveDate and ExpirationDate ... which determine if the session is expired ).
- Logic for purging expired sessions and return the online users count after the purging.
ASP.NET
Web Server logic:
Web the application is started ( Application_Start Global.asax ) i start a System.TIMERS.TIMER with interval of 10 minutes. Every 10 minutes i get the registered users count, purge the expired sessions , get online users count and keep the stored data as static. On Application_End i dispose the timer.
However all my web forms are inherited by a base form in which "Page_Load" handler i idicate an activity and update the session information table on the sql server.
I'm not quite sure if my logic is right about all those steps. Please comment.
Best wishesh , Hristiyan
|
|
|
|
|
Hi,
1. Why do you store the user count separately? What is wrong with count(*)? You have to write much more code (possible point of bugs etc.) when you store the count in an extra table.
2. Why do you store the session information within a table? You could use a static dataobject (could be a simple int) within your ASP.NET application. Just increment/decrement the counter whenever a session ends (use Global.asax for this)
3. To update the visible count on your site just query the static dataobject to get the active users. To get all registered users use the sql-query. You could do something like "Store the value for one hour. After one hour ask query the registered users again" You don't need a timer for this, just do it in a master page whenever you get a postback. To update the site you could use a little JavaScript that will force the client to update in an interval.
Hope this helps you a bit.
Regards
Sebastian
|
|
|
|
|
Thank you for your answer !
My oppinion (I'm not saying it's correct.... it's just what i think) :
1. Assume i have 100 000 users. SELECT COUNT(*) "count every time all the users when that statement is executed". Thats some really big unnecessary weight over the SQL server. I don't think thats the right approach.
2. I think that logic is incorrect. You don't increment and decrement the the online users when the Session_Start and Session_End. Assume that the user closes the browser. The logic fails there - it will actually count that user as online.
3. I think that logic is incorrect. You cannot query the database with that unnecessary logic weight every time there is a postback. That will make a segnificant performance loss.
I store the session info in the database, because it's needed for other purposes too. However i update it every time a user makes a postback and purge the expired data every 10 minutes.
Please give advices.
Best wishes , Hristiyan !
|
|
|
|
|
1.+3. Well that's why I said you could store it in a variable that will be update every hour or so...
2. The problem is that you can't get the event if the user closes the browser. What you will get is a session end, when the timeout expires... so the mechanism implemented with the session object (timeout etc.) is the same as you have written by yourself (as you explained in your first message).
Every I/O action takes time. If you have 10.000 users online you will have at approx. 1.000 sql inserts/updates every minute when you update the session data within your sql server. Using a select count(*) every hour seems a blink of an eye to me then.
Regards
Sebastian
|
|
|
|
|
However , since i've already implemented my logic ( now i'm testing it ), i'm going to ask you in general: Do you strong disagree with my logic ?
Do you see a reasonable point to delete my current implementation and "make it the easy way" ?
Regards , Hristiyan
|
|
|
|
|
If you already implemented it and it is working I wouldn't throw away the logic. But if you encouter any problems at a later point I would think about refactoring.
Regards
Sebastian
|
|
|
|
|
Hello,
I have an ecommerce website where I have a page named "buynow.aspx". In this page's code behind file, (buynow.aspx.cs) I have referenced many classes which are available in App_Code folder. Also this page calls many classes whose dlls are in Bin folder of the Web application.
Now, I want to accept credit card payments in buynow.aspx page and so I will need to place this page in the httpsdocs folder of my web server. Now, my question is, will I need to create Bin folder, App_Code folder, etc all in the httdocs folder ? Or, is there any smart way so that I can place some information in Web.Config file so that, only buynow.aspx page is treated as SSL page but I dont need to create a duplicate Web application in the httpsdocs folder of my hosting ?
NB:I searched in google about this specific tutorial but did not find any (may be I dont know the right keyword). If you have any article link, please let me know too.
Regards
|
|
|
|
|
i have a userControl and am using it in a aspx page, now i have expose the Following Method that reside in the usercontrol like this
public void load_Again()
{
string clientscript = "";
clientscript = "var txtbxActvClientID = '" + txtbxActvs.ClientID.ToString() + "'; ";
ClientScriptManager cs = Page.ClientScript;
cs.RegisterClientScriptBlock(this.GetType(), "txtbxlookupid", clientscript, true);
HighlightSelectedActvs();
}
and am calling it on my aspx page like this
ActivityCtrl1.load_Again();
i have Copied the code you see in the method load_Again() from the page load event of the Control. I want refresh or load the page again after i click a button in my aspx page.
Thank you
Vuyiswa Maseko,
Few companies that installed computers to reduce the employment of clerks have realized their expectations.... They now need more and more expensive clerks even though they call them "Developers" or "Programmers."
C#/VB.NET/ASP.NET/SQL7/2000/2005/2008
http://www.vuyiswamaseko.tiyaneProperties.co.za
vuyiswa@its.co.za
http://www.itsabacus.co.za/itsabacus/
|
|
|
|
|
use button as asp:button and it will do a postback call where you can do whatever you want.
Prince
www.imaginethinkact.com
|
|
|
|
|
I really don't understand what you just wrote , can you please explain clearer ? 
Vuyiswa Maseko,
Few companies that installed computers to reduce the employment of clerks have realized their expectations.... They now need more and more expensive clerks even though they call them "Developers" or "Programmers."
C#/VB.NET/ASP.NET/SQL7/2000/2005/2008
http://www.vuyiswamaseko.tiyaneProperties.co.za
vuyiswa@its.co.za
http://www.itsabacus.co.za/itsabacus/
|
|
|
|
|
ActivityCtrl1.load_Again();
Is this written on Page_Load of your aspx page?
|
|
|
|
|
Yes and declared Public in the User Control
Vuyiswa Maseko,
Few companies that installed computers to reduce the employment of clerks have realized their expectations.... They now need more and more expensive clerks even though they call them "Developers" or "Programmers."
C#/VB.NET/ASP.NET/SQL7/2000/2005/2008
http://www.vuyiswamaseko.tiyaneProperties.co.za
vuyiswa@its.co.za
http://www.itsabacus.co.za/itsabacus/
|
|
|
|
|
Can you put this code (for LoadAgain()) inside the page load event of user control?
If it is a dynamic user control, it needs to be regenerated on post back of page.
Thanks & Regards,
Nyoti
|
|
|
|
|
After the button has been clicked i have Forced a Postback by doing this
response.redirect("Subjectscruct.aspx",false");
and it worked, is this an efficient way ?
Thank you
Vuyiswa Maseko,
Few companies that installed computers to reduce the employment of clerks have realized their expectations.... They now need more and more expensive clerks even though they call them "Developers" or "Programmers."
C#/VB.NET/ASP.NET/SQL7/2000/2005/2008
http://www.vuyiswamaseko.tiyaneProperties.co.za
vuyiswa@its.co.za
http://www.itsabacus.co.za/itsabacus/
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
