Suggestions to prevent VICIOUS data input?

Using ASP.NET 2.0/SQL Express...

In places where I allow data input by users (sign up forms, comments,
etc...) do I need to manually safeguard my site against vicious attacks (SQL
injection, etc...)? Should I just run all input thru a filter that removes
all special characters, like asterick, semicolon, etc...? Or, is this
handled internally so I don't have to worry about it? Any suggestions?

Thanks.VB Programmer wrote:
> Using ASP.NET 2.0/SQL Express...
> In places where I allow data input by users (sign up forms, comments,
> etc...) do I need to manually safeguard my site against vicious attacks (SQL
> injection, etc...)? Should I just run all input thru a filter that removes
> all special characters, like asterick, semicolon, etc...? Or, is this
> handled internally so I don't have to worry about it? Any suggestions?
> Thanks.

It depends... You can validate your form entries with regular
expressions (client side AND server side) and the like. Other than that,
the main thing is using parameterized queries - *NOT* string
concatenation to make your SQL queries (that's really asking for
trouble). That would be a good start :) ASP.NET also does protect you to
some extent.
john smith wrote:
> VB Programmer wrote:
> > Using ASP.NET 2.0/SQL Express...
> > In places where I allow data input by users (sign up forms, comments,
> > etc...) do I need to manually safeguard my site against vicious attacks (SQL
> > injection, etc...)? Should I just run all input thru a filter that removes
> > all special characters, like asterick, semicolon, etc...? Or, is this
> > handled internally so I don't have to worry about it? Any suggestions?
> > Thanks.
> It depends... You can validate your form entries with regular
> expressions (client side AND server side) and the like. Other than that,
> the main thing is using parameterized queries - *NOT* string
> concatenation to make your SQL queries (that's really asking for
> trouble). That would be a good start :) ASP.NET also does protect you to
> some extent.

What he said ^

Also, when using regular expressions, look for GOOD input, and reject
anything that doesn't match. Doing it the other way around, you're
bound to miss something...

Damien
Hi, as part of your research, you should investigate a product I wrote that
handles SQL Injection and Cross Site Scripting attacks. It is VAM: Visual
Input Security. (http://www.peterblum.com/vise/home.aspx)

-- Peter Blum
www.PeterBlum.com
Email: PLBlum@.PeterBlum.com
Creator of "Professional Validation And More" at
http://www.peterblum.com/vam/home.aspx

"VB Programmer" <dont@.emailme.com> wrote in message
news:eGdttg6JGHA.916@.TK2MSFTNGP10.phx.gbl...
> Using ASP.NET 2.0/SQL Express...
> In places where I allow data input by users (sign up forms, comments,
> etc...) do I need to manually safeguard my site against vicious attacks
> (SQL injection, etc...)? Should I just run all input thru a filter that
> removes all special characters, like asterick, semicolon, etc...? Or, is
> this handled internally so I don't have to worry about it? Any
> suggestions?
> Thanks.

Suggestions to prevent VICIOUS data input?

Using ASP.NET 2.0/SQL Express...
In places where I allow data input by users (sign up forms, comments,
etc...) do I need to manually safeguard my site against vicious attacks (SQL
injection, etc...)? Should I just run all input thru a filter that removes
all special characters, like asterick, semicolon, etc...? Or, is this
handled internally so I don't have to worry about it? Any suggestions?
Thanks.VB Programmer wrote:
> Using ASP.NET 2.0/SQL Express...
> In places where I allow data input by users (sign up forms, comments,
> etc...) do I need to manually safeguard my site against vicious attacks (S
QL
> injection, etc...)? Should I just run all input thru a filter that remove
s
> all special characters, like asterick, semicolon, etc...? Or, is this
> handled internally so I don't have to worry about it? Any suggestions?
> Thanks.
>
It depends... You can validate your form entries with regular
expressions (client side AND server side) and the like. Other than that,
the main thing is using parameterized queries - *NOT* string
concatenation to make your SQL queries (that's really asking for
trouble). That would be a good start :) ASP.NET also does protect you to
some extent.
john smith wrote:
> VB Programmer wrote:
> It depends... You can validate your form entries with regular
> expressions (client side AND server side) and the like. Other than that,
> the main thing is using parameterized queries - *NOT* string
> concatenation to make your SQL queries (that's really asking for
> trouble). That would be a good start :) ASP.NET also does protect you to
> some extent.
What he said ^
Also, when using regular expressions, look for GOOD input, and reject
anything that doesn't match. Doing it the other way around, you're
bound to miss something...
Damien
Hi, as part of your research, you should investigate a product I wrote that
handles SQL Injection and Cross Site Scripting attacks. It is VAM: Visual
Input Security. (http://www.peterblum.com/vise/home.aspx)
-- Peter Blum
www.PeterBlum.com
Email: PLBlum@.PeterBlum.com
Creator of "Professional Validation And More" at
http://www.peterblum.com/vam/home.aspx
"VB Programmer" <dont@.emailme.com> wrote in message
news:eGdttg6JGHA.916@.TK2MSFTNGP10.phx.gbl...
> Using ASP.NET 2.0/SQL Express...
> In places where I allow data input by users (sign up forms, comments,
> etc...) do I need to manually safeguard my site against vicious attacks
> (SQL injection, etc...)? Should I just run all input thru a filter that
> removes all special characters, like asterick, semicolon, etc...? Or, is
> this handled internally so I don't have to worry about it? Any
> suggestions?
> Thanks.
>

Suppress postback added to history WITHOUT smartnavigation

I remember hearing that you could use javascript document.location.href to p
revent a link from being added to the browser history.
Has anyone found a way to implement this behaviour for page postbacks withou
t using smartnavigation?
SmartNavigation causes me too many javascript headaches. Anyone know of a ba
se page class (or something) that would accomplish that feature of smartnavi
gation?
Or perhaps you happen to be using CoolMenus and know how to fix the page so
it works with SmartNavigation :) ?
Thanks for any help.
From: Mark Petersen
Posted by a user from .NET 247 (http://www.dotnet247.com/)
<Id>emWuhAFdl0mktgkkLUxWpQ==</Id>Hello,
> Has anyone found a way to implement this behaviour for page postbacks without usin
g smartnavigation?
This article deals with that issue:
Maintaining Scroll Position on Postback (without SmartNavigation)
http://aspnet.4guysfromrolla.com/articles/111704-1.aspx
"Mark Petersen via .NET 247" wrote:

> I remember hearing that you could use javascript document.location.href to
prevent a link from being added to the browser history.
> Has anyone found a way to implement this behaviour for page postbacks with
out using smartnavigation?
> SmartNavigation causes me too many javascript headaches. Anyone know of a
base page class (or something) that would accomplish that feature of smartna
vigation?
> Or perhaps you happen to be using CoolMenus and know how to fix the page s
o it works with SmartNavigation :) ?
> Thanks for any help.
> --
> From: Mark Petersen
> --
> Posted by a user from .NET 247 (http://www.dotnet247.com/)
> <Id>emWuhAFdl0mktgkkLUxWpQ==</Id>
>