Web Development

3-Nov-02 22:24

I am aware one should do this on the server side of things for security reasons...I assume it has to do with the fact that it's pretty easy easy to create a bunk form and send malicious data, that if not parsed at the sever end...could run system commands and SQL statements like 'DROP TABLE' Dead | X|

So what i'd like to know is it possible for a PHP/ASP script to determine if the data is coming from a form on a web page on my site...???

I'm thinking refferal IP or whatever (i'd have to peak at my docs but you know what I mean) i could check that and if it didn't match then I wouldn't accept the data...

Would this be acceptable or would i cause serious security loop holes???

p.s-The reason I ask is i've designed a messsage forum system like here at CP, but I wanna strip the naughty words out at the client end as a user sends the message, instead of on the server...

Thanx Smile | :)

"An expert is someone who has made all the mistakes in his or her field" - Niels Bohr

Pete Bassett3-Nov-02 23:34

Pete Bassett

3-Nov-02 23:34

Hi, your main question is about validation of the user really isn't it?

Are you requireing the user to be logged in before allowing them to post? If so, simple checks for a login id stored in Session would suffice to check if the post was coming from a valid place.

Another thing. In ASP if you dont want to have stuff like DROP TABLE run, just use the command object. You shouldn't ever build an SQL string if you cant trust the source.

E.g. "Select * From Customer Where Name = '" & strName & "'"

Can be broken by typing in

' DROP TABLE Customer --

Which would build the SQL string

Select * From Customer Where Name = '' DROP TABLE Customer -- '

All is lost! Fires of Hell!

So, just use the Command object instead.

E.g. (Off the top of my head)

Dim objCommand as new Command

set objCommand.ActiveConnection = objConn ' Get the connection elsewhere
objCommand.CommandText = "Select * From Customer Where Name = '@Name'"
objCommand.parameters.Add("@Name", strName)

dim rs as Recordset
set rs = objCommand.Execute

I cant remember which version of ASP/ADO you need to run names parameters but its in there somewhere, unless I'm completely forgetting something.

Executing this code should really check for the presence of a name "' DROP TABLE Customer --" in the customer.Name field rather than executing the code.

So, using these two methods you dont really need to worry where things come from. So, write your client side profanity stripper and if the user isn't logged on, dont let them post.

Pete

Insert Sig. Here!

markkuk4-Nov-02 1:51

markkuk

4-Nov-02 1:51

No, it's trivial to write a program that sends a HTTP POST request with any headers you want, including "Referer:". It's not a security mechanism.

alex.barylski4-Nov-02 21:29

4-Nov-02 21:29

Trivial...?

How do you do it then...? What would be the steps involved...?

Thanx! Smile | :)

"An expert is someone who has made all the mistakes in his or her field" - Niels Bohr

Pete Bassett4-Nov-02 22:05

Pete Bassett

4-Nov-02 22:05

HTTP is just a text protocol. All you have to do is create a Socket connection to the web server on port 80 and sent a property formatted HTTP request to it. GET and POST are equally easy to do.

But, of course, you really have to want to annoy the web server to go and write an app to do it.

Pete

Pete

Insert Sig. Here!

alex.barylski5-Nov-02 6:14

5-Nov-02 6:14

Ah...you have to use a compiled language...

I have always been under the impression you could accomplish this with JScript or Php, but I could NEVER figure out how...

"An expert is someone who has made all the mistakes in his or her field" - Niels Bohr

markkuk5-Nov-02 8:49

markkuk

5-Nov-02 8:49

You could use Perl or Python. For example, here's an excerpt of the Python manual showing how to send a POST request. Just change the "headers" variable to suit yor needs:

>>> import httplib, urllib
>>> params = urllib.urlencode({'spam': 1, 'eggs': 2, 'bacon': 0})
>>> headers = {"Content-type": "application/x-www-form-urlencoded",
...            "Accept": "text/plain"}
>>> conn = httplib.HTTPConnection("musi-cal.mojam.com:80")
>>> conn.request("POST", "/cgi-bin/query", params, headers)
>>> response = conn.getresponse()
>>> print response.status, response.reason
200 OK
>>> data = response.read()
>>> conn.close()

The >>> and ... prompts in the line starts mean that you are supposed to type the stuff directly to a Python interpreter. Try it if you have Python installed. The variable "data" will contain the HTML returned by the server.

Vasudevan Deepak Kumar5-Nov-02 16:35

Vasudevan Deepak Kumar

5-Nov-02 16:35

Hi,

Actually in PHP, there is a builtin function called

'escapeshellcmd' to automatically escape shell commands and pass them as plain text.

http://www.php.net/manual/en/function.escapeshellcmd.php

I think PHPMyAdmin (the PHP interface to MYsQL) has some features to disable queries with Drop etc.) Seeing that you can get how they have achieved this.

Perhaps in ASP, you may have to mimic the above functionality to deter the user from passing potentially harmful commands to the system.

Deepak Kumar Vasudevan
http://deepak.portland.co.uk/

alex.barylski6-Nov-02 9:16

6-Nov-02 9:16

Cool PHP is my language of choice for server side scripting, but I have yet to ocome across this function...

i'll have to check it out...

Thanx! Smile | :)

"An expert is someone who has made all the mistakes in his or her field" - Niels Bohr

IE colspan bug

leppie3-Nov-02 5:51

3-Nov-02 5:51

Hi all

OK I have posted this "bug" (flaw) before but wasnt sure what was causing it, but I have now pinned it down. Have look at the following and paste into a page.

<table width="100%" border="1">
  <tr> 
    <td>Some Text</td>
    <td width="200">Some Text</td>
  </tr>
  <tr> 
    <td colspan=2>Some Text</td>
  </tr>
</table>
<br>
<table width="100%" border="1">
  <tr> 
    <td>Some Text</td>
    <td width="200">Some Text</td>
  </tr>
  <tr> 
    <td colspan=2>Some really really really really really really long boring Text to prove my point just as long as it is wider than the above right column</td>
  </tr>
</table>

OK some mite say this is not a bug, but what must I do then to "render" something as simple as the above. NS 6 / Mozilla 1.1 renders this correctly IMHO.

ANy suggestions welcome Smile | :)

[edit] it seems the colspan'ed TD "binds" to the last TD that it is spanning, this is dumb IMO, it should "bind" to the 1st TD or infact all of them...[/edit]

"There are no stupid question's, just stupid people."

Stephane Rodriguez.3-Nov-02 6:37

Stephane Rodriguez.

3-Nov-02 6:37

Didn't I tell you already there is no warrant regarding the user agent implementation ?

To get this displayed fine with IE, add this class :

<STYLE TYPE="text/css">
<!--
.TABLEFIXED { table-layout:fixed }
-->
</STYLE>

And set the class="TABLEFIXED" attribute to both table tags.

Back to real work : D-27.

leppie3-Nov-02 7:39

3-Nov-02 7:39

Thank you, Thank you, Thank you! Smile | :)

I can live with problems if there are solutions Smile | :)

"There are no stupid question's, just stupid people."

Paul Watson3-Nov-02 20:09

3-Nov-02 20:09

Why don't you use CSS to define the widths rather? Then the odd bug does not appear.

Paul Watson
Bluegrass
Cape Town, South Africa

Ray Cassick wrote:
Well I am not female, not gay and I am not Paul Watson

leppie4-Nov-02 8:21

4-Nov-02 8:21

Paul Watson wrote:
Why don't you use CSS to define the widths rather?

Hmm, thanx , I'll try that Smile | :)

So CSS styles work for almost all table elements?

"There are no stupid question's, just stupid people."

Paul Watson4-Nov-02 8:23

4-Nov-02 8:23

leppie wrote:
So CSS styles work for almost all table elements?

Oh yeah fully. CSS can be applied to any element within (and including) the BODY element. You can apply CSS classes to TD, TR, BODY, TH, FORM etc. etc. etc. Absolutely any element.

Paul Watson
Bluegrass
Cape Town, South Africa

Ray Cassick wrote:
Well I am not female, not gay and I am not Paul Watson

Roger Wright4-Nov-02 10:16

Roger Wright

4-Nov-02 10:16

Since you recommended CSS months back I've been playing with them. Very effective!!!

"When in danger, fear, or doubt, run in circles, scream and shout!" - Lorelei and Lapis Lazuli Long

leppie5-Nov-02 6:26

5-Nov-02 6:26

Paul Watson wrote:
Then the odd bug does not appear.

I tried the table using CSS to set widths but it still does that if I dont add the table-layout:fixed style. I can live with that though...the forum site I'm working on too doesnt like fixed layout at all , so I guess its back to the drawing board Frown | :(

"There are no stupid question's, just stupid people."

Best font opinion

leppie3-Nov-02 3:31

3-Nov-02 3:31

Hi all

What font do you consider the best for viewing webpages (generally content, not menus).

This is my preference : Tahoma, Verdana, Arial

Any one have problems with that?

"There are no stupid question's, just stupid people."

Paul Watson3-Nov-02 4:45

3-Nov-02 4:45

leppie wrote:
Any one have problems with that?

LOL. Or else what? hehe.

leppie wrote:
What font do you consider the best for viewing webpages (generally content, not menus).

font-family: Verdana, Helvetica, Arial, Sans-Serif is our choice.

Paul Watson
Bluegrass
Cape Town, South Africa

Ray Cassick wrote:
Well I am not female, not gay and I am not Paul Watson

leppie3-Nov-02 5:18

3-Nov-02 5:18

Paul Watson wrote:
Verdana

Alot of people tend to like that, personally I find the letters are too widely spaced, maybe its just me WTF | :WTF:

"There are no stupid question's, just stupid people."

Paul Watson3-Nov-02 5:21

3-Nov-02 5:21

leppie wrote:
personally I find the letters are too widely spaced, maybe its just me

Maybe. Generally good spacing between letters and lines helps readability. I always have a line-height of 130% and a letter spacing of 1px on content rich sites. Also keep paragraphs no wider than 45em.

Paul Watson
Bluegrass
Cape Town, South Africa

Ray Cassick wrote:
Well I am not female, not gay and I am not Paul Watson

leppie3-Nov-02 6:15