Precautions for developing web pages using ASP

Step 2

1. Never trust that the content entered by the user has an appropriate size or contains appropriate characters. User input should always be verified before making a decision using it. The best choice is to create a COM + component, so that you can call this component from the ASP page to verify the user's input content. You can also use server. htmlencode, server. urlencode, or Code In the example.
2. Do not create a database connection string on the ASP page by connecting to the string entered by the user. Malicious users can insert Code into their input content to obtain database access permissions. If you are using an SQL database, use the stored procedure to create a database connection string.
3. Do not use the default SQL Administrator Account Name SA. Every SQL user knows that the SA account exists. Create other SQL management accounts with secure and reliable passwords and delete SA accounts.
4. Before you store the client user passwords, use a hash for these passwords. Algorithm Or use server. htmlencode or server. urlencode for encoding. You can also use a code example at the bottom of this page to verify the characters in the client password.
5. Do not place the account name or password on the management script or ASP page.
6. Do not make decisions in the code based on the request title, because the title data can be forged by malicious users. Before using the request data, you must always encode it or use the following code example to verify the characters it contains.
7. Do not store security data in cookies or hide input fields in webpages.
Always use Secure Socket Layer (SSL) for session-based applications Program To avoid the risk of sending session cookies without encrypting them. If the session cookie is not encrypted, a malicious user can use the session cookie in an application to access another application in the same process.
8. When writing ISAPI applications, filters, or COM + objects, note the buffer overflow caused by the size of variables and data. Note also the possible normalization problems caused by interpretation, such as interpreting absolute pathnames as relative pathnames or URLs.
9. When an ASP application running in a single thread unit (STA) switches to a multi-thread unit (MTA), the simulated token will expire. This may cause the application to run without simulation, so that the identity of the process that may allow access to other resources can be effectively run. If you must switch the thread model, disable the application and uninstall it before making changes.

Sample Code

This code example contains a function that can delete potentially harmful characters from strings sent to the function. In the preceding two examples, specify the code page to ensure correct encoding. The following example uses Microsoft Visual Basic Scripting Edition (VBScript ):

<% @ Language = "VBScript" %> <% Response. codePage = 1252 Response. Write ("hello," & removebadcharacters (request. Form ("username "))) Response. Write ("<br> This is why you have ED an error :") Function removebadcharacters (strtemp) Dim RegEx Set RegEx = new Regexp RegEx. pattern = "[^ \ s \ W]" RegEx. Global = true Removebadcharacters = RegEx. Replace (strtemp ,"") End Function %>

The following example uses Microsoft JScript:

<% @ Language = "jscript" %> <% response. codePage = 1252; response. write ("hello," + removebadcharacters (request. form ("username"); response. write (" This is why you have ED an error:"); function removebadcharacters (strtemp) { strtemp = strtemp. replace (/[^ \ s \ W]/g, ""); return strtemp; }< BR >%>