Notes for developing ASP Web pages

Notes for ASP development web pages: Select Blog from RAINMAN_NET
Notes for developing web pages with ASP keywords
Source

Never trust that the content entered by the user has an appropriate size or contains appropriate characters. User input should always be verified before making a decision using it. The best choice is to create a COM + component, so that you can call this component from the ASP page to verify the user's input content. You can also use the Server. HTMLEncode method, Server. URLEncode method, or one of the code examples at the bottom of this page.
Do not create a database connection string on the ASP page by connecting to the string entered by the user. Malicious users can insert Code into their input content to obtain database access permissions. If you are using an SQL database, use the stored procedure to create a database connection string.
Do not use the default SQL Administrator Account Name sa. Every SQL user knows that the sa account exists. Create other SQL management accounts with secure and reliable passwords and delete sa accounts.
Before you store client user passwords, use the hash algorithm and base64 encoding for these passwords, or use Server. HTMLEncode or Server. URLEncode for encoding. You can also use a code example at the bottom of this page to verify the characters in the client password.
Do not place the management account name or password in the management script or ASP page.
Do not make decisions in the code based on the request title, because the title data can be forged by malicious users. Before using the request data, you must always encode it or use the following code example to verify the characters it contains.
Do not store security data in cookies or hide input fields in webpages.
Always use Secure Sockets Layer (SSL) for session-based applications to avoid the risk of sending session cookies without encrypting them. If the session Cookie is not encrypted, a malicious user can use the session Cookie in an application to access another application in the same process.
When writing ISAPI applications, filters, or COM + objects, note the buffer overflow caused by the size of variables and data. Note also the possible normalization problems caused by interpretation, such as interpreting absolute pathnames as relative pathnames or URLs.
When an ASP application running in a single-threaded unit (STA) switches to a multi-threaded unit (MTA), the simulated token will expire. This may cause the application to run without simulation, so that the identity of the process that may allow access to other resources can be effectively run. If you must switch the thread model, disable the application and uninstall it before making changes.

Sample Code
This code example contains a function that can delete potentially harmful characters from strings sent to the function. In the preceding two examples, specify the code page to ensure correct encoding. The following example uses Microsoft Visual Basic? Scripting Edition (VBScript ):

<% @ LANGUAGE = "VBScript" %>
<%
Response. CodePage = 1252
Response. Write ("Hello," & RemoveBadCharacters (Request. Form ("UserName ")))
Response. Write ("<BR> This is why you have ED an error :")

Function RemoveBadCharacters (strTemp)
Dim regEx
Set regEx = New RegExp
RegEx. Pattern = "[^ \ s \ w]"
RegEx. Global = True
RemoveBadCharacters = regEx. Replace (strTemp ,"")
End Function
%>

The following example uses Microsoft JScript? :

<% @ LANGUAGE = "JScript" %>
<%
Response. CodePage = 1252;
Response. Write ("Hello," + RemoveBadCharacters (Request. Form ("UserName ")));
Response. Write ("<BR> This is why you have ED an error :");

Function RemoveBadCharacters (strTemp ){
StrTemp = strTemp. replace (/[^ \ s \ w]/g ,"");
Return strTemp;
}
%>

From wanghai zhibei