Ask a Question related to ASP.NET Security, Design and Development.
-
Ken Schaefer #1
Re: Preventing script attacks from text boxes
The HTML code that the users are entering. Is this supposed to be displayed
as text to others? If so, you can use Server.HTMLEncode()
Is it supposed to be interpreted by the browser as HTML? If so, you need to
define what types of HTML the user can legitimately enter, and what they
can't. If the user is legitimately allowed to enter client-side script, then
I think you'll need to have policies in place to deal with this - you'd be
hard pressed to develop a technological solution that can distinguish
between good/inocuous script and "bad" script (whatever that may be).
Cheers
Ken
"DDK" <ddkennard@hotmail.com> wrote in message
news:OloWwjoQEHA.3420@TK2MSFTNGP11.phx.gbl...
: I am trying to figure out the best way to allow users to submit HTML in a
: textbox, and allow them the ability to edit the text HTML submitted
: afterwards safely in ASP.NET + C# (submitted to a sql server database), so
: that the application is not subject to script attacks. Any ideas on the
best
: options for this.
: thanks,
: d.
:
:
Ken Schaefer Guest
-
Hyperlink text issue, two text boxes, one disfuntional
Hi, I have created a frame in director with two buttons and two text documents. When you click one button, you see a text document, when you click... -
ksh script - Preventing multiple runs of a particular script
I am having trouble with a ksh script I am writing. I need to make sure that the script is not already running when it is kicked off in cron. ... -
Preventing windows from suggesting usernames in login boxes??
How can I prevent this from happening? For example when the asp application works in a public terminal where we don't want successive users to know... -
Preventing SQL Injection Attacks
In article <qdu3gvs8qq052805u6rtb08gmc1bblv5oc@4ax.com>, James wrote: This is an option and most effective: $query = "select * from sample... -
seperating columns in a text box into multiple text boxes?
Berney: You probably are better off doing this separating in the query data source for your form. You can use string commands to find which...
Reply With QuoteSimilar Questions and Discussions
Posting Permissions
- You may not post new threads
- You may post replies
- You may not post attachments
- You may not edit your posts
