Verify the Session verification code and avoid bypassing the verification code attack.

You can't remember the website on which the verification code is displayed. Generally, you can easily write the Verification Code as follows: Copy codeThe Code is as follows: <%
If Request. Form ("SecurityCode") = Session ("SecurityCode") Then
'Todo: Database operations
Else
Response. Write "Security code incorrect! "
End If
%>

The verification code image generates the Session ("SecurityCode"), saves the correct verification code value, and obtains the verification code value submitted by the user. If the two verification codes are the same, the verification code is correct. Otherwise, the verification code is incorrect. On the surface, there is no problem with such an algorithm, but in a special case, the verification code will be virtually empty.
First, we know that the core of the above algorithm is that we need to access the file that generates the verification code image to have a Session that saves the verification code value, then, the user's input can be correctly compared. If someone is interested in constructing a Form that bypasses the verification code image file and then submitting it, what will get? The Session ("SecurityCode") does not exist. If no verification code is entered at this time, the verification code is virtually empty. Well, the key to exploiting the vulnerability attack here is the verification code Session. We can easily prevent the server from generating this Session to make this attack possible.
The solution is also easy. Check whether the verification code Session is empty or whether the verification code entered by the user is valid. The key to constructing a security form is never to trust the user input. The following uses the verification code Session and the double insurance method entered by the user to solve this security problem:Copy codeThe Code is as follows: 'str is the verification code to be verified, and len is the verification code length.
Function IsSecurityCodeValid (str, len)
IsSecurityCodeValid = Not CBool (_
IsEmpty (str) Or CStr (str) = "" Or Len (str) <len)
End Function
If IsSecurityCodeValid (Request. Form ("SecurityCode"), 4) AND _
IsSecurityCodeValid (Session ("SecurityCode"), 4) AND _
Request. Form ("SecurityCode") = Session ("SecurityCode") Then
'Todo: Database operations
Else
Response. Write "Security code incorrect! "
End If