Hi,
I have an aspx page with some server side textboxes.
I have a button onmy page which allows users to add data
to a database.
In my onclick event for my button when I try and get teh
value from the textbox using..
Dim myString as String = textbox1.text
...it is blank.
When I do a..
Dim myString = Request.Form("textbox1")
...I get the value the user enetered.
I have declared my textbox as a control in my codebehind.
And it is an asp.net textbox.
Any ideas why this is?
This is baffling me.
Kerri.Have you added the "runat=server" attribute to the template HTML for the
text box?
--
HTH,
Kevin Spencer
Microsoft MVP
..Net Developer
http://www.takempis.com
Big Things are made up of
Lots of Little Things.
"Kerri" <anonymous@.discussions.microsoft.com> wrote in message
news:017401c39cc4$12c55070$a501280a@.phx.gbl...
> Hi,
> I have an aspx page with some server side textboxes.
> I have a button onmy page which allows users to add data
> to a database.
> In my onclick event for my button when I try and get teh
> value from the textbox using..
> Dim myString as String = textbox1.text
> ..it is blank.
> When I do a..
> Dim myString = Request.Form("textbox1")
> ..I get the value the user enetered.
> I have declared my textbox as a control in my codebehind.
> And it is an asp.net textbox.
> Any ideas why this is?
> This is baffling me.
> Kerri.
Showing posts with label users. Show all posts
Showing posts with label users. Show all posts
Saturday, March 31, 2012
Monday, March 26, 2012
Server Transfer and Back/Refresh...
Apparently, our developers used "server transfer" in our ASP.NET, and
because of this Back/Refresh presses by users are problematic. Apparently
the server has information about state and other things that the browser
does not. The application could get very
on Back/Refresh presses.
Is the use of "server transfer' just a bad idea for our type of application?
Can we prevent or nullify Back/Refresh presses using javascript? Bad idea?
Any words or links will be greatly appreciated!
JamesHi James,
I think you have to set EnableViewStateMac property of page directive
to true for not to tamper your session or view state values. Also set
SmartNavigation to true.
Check the below link.
http://msdn.microsoft.com/library/d... />
onPage.asp
Cheers,
Kris
> Is the use of "server transfer' just a bad idea for our type of
> application?
Yes and no. Everything has it's place but mostly you should avoid to use
Server.Transfer just because of those problems.
>Can we prevent or nullify Back/Refresh presses using javascript?
Afraid no. The user is in control and it's hard to prevent him doing that.
George.
"James Hunter Ross" <james.ross@.oneilsoft.com> wrote in message
news:%23H0blalNGHA.1288@.TK2MSFTNGP09.phx.gbl...
> Apparently, our developers used "server transfer" in our ASP.NET, and
> because of this Back/Refresh presses by users are problematic. Apparently
> the server has information about state and other things that the browser
> does not. The application could get very on Back/Refresh
> presses.
> Is the use of "server transfer' just a bad idea for our type of
> application?
> Can we prevent or nullify Back/Refresh presses using javascript? Bad
> idea?
> Any words or links will be greatly appreciated!
> James
>
Thus wrote James,
> Apparently, our developers used "server transfer" in our ASP.NET, and
> because of this Back/Refresh presses by users are problematic.
> Apparently the server has information about state and other things
> that the browser does not. The application could get very on
> Back/Refresh presses.
> Is the use of "server transfer' just a bad idea for our type of
> application? Can we prevent or nullify Back/Refresh presses using
> javascript? Bad idea?
Bad idea. Turn off scripting and... boom.
There's really just one way to fix this: Make your application immune agains
t
these effects, like using Redirect-After-Post or applying synchronizer token
s
in your web forms.
Cheers,
--
Joerg Jooss
news-reply@.joergjooss.de
because of this Back/Refresh presses by users are problematic. Apparently
the server has information about state and other things that the browser
does not. The application could get very
on Back/Refresh presses.Is the use of "server transfer' just a bad idea for our type of application?
Can we prevent or nullify Back/Refresh presses using javascript? Bad idea?
Any words or links will be greatly appreciated!
JamesHi James,
I think you have to set EnableViewStateMac property of page directive
to true for not to tamper your session or view state values. Also set
SmartNavigation to true.
Check the below link.
http://msdn.microsoft.com/library/d... />
onPage.asp
Cheers,
Kris
> Is the use of "server transfer' just a bad idea for our type of
> application?
Yes and no. Everything has it's place but mostly you should avoid to use
Server.Transfer just because of those problems.
>Can we prevent or nullify Back/Refresh presses using javascript?
Afraid no. The user is in control and it's hard to prevent him doing that.
George.
"James Hunter Ross" <james.ross@.oneilsoft.com> wrote in message
news:%23H0blalNGHA.1288@.TK2MSFTNGP09.phx.gbl...
> Apparently, our developers used "server transfer" in our ASP.NET, and
> because of this Back/Refresh presses by users are problematic. Apparently
> the server has information about state and other things that the browser
> does not. The application could get very
on Back/Refresh> presses.
> Is the use of "server transfer' just a bad idea for our type of
> application?
> Can we prevent or nullify Back/Refresh presses using javascript? Bad
> idea?
> Any words or links will be greatly appreciated!
> James
>
Thus wrote James,
> Apparently, our developers used "server transfer" in our ASP.NET, and
> because of this Back/Refresh presses by users are problematic.
> Apparently the server has information about state and other things
> that the browser does not. The application could get very
on> Back/Refresh presses.
> Is the use of "server transfer' just a bad idea for our type of
> application? Can we prevent or nullify Back/Refresh presses using
> javascript? Bad idea?
Bad idea. Turn off scripting and... boom.
There's really just one way to fix this: Make your application immune agains
t
these effects, like using Redirect-After-Post or applying synchronizer token
s
in your web forms.
Cheers,
--
Joerg Jooss
news-reply@.joergjooss.de
Server Transfer and Back/Refresh...
Apparently, our developers used "server transfer" in our ASP.NET, and
because of this Back/Refresh presses by users are problematic. Apparently
the server has information about state and other things that the browser
does not. The application could get very confused on Back/Refresh presses.
because of this Back/Refresh presses by users are problematic. Apparently
the server has information about state and other things that the browser
does not. The application could get very confused on Back/Refresh presses.
Is the use of "server transfer' just a bad idea for our type of application?
Can we prevent or nullify Back/Refresh presses using javascript? Bad idea?
Any words or links will be greatly appreciated!
JamesHi James,
I think you have to set EnableViewStateMac property of page directive
to true for not to tamper your session or view state values. Also set
SmartNavigation to true.
Check the below link.
http://msdn.microsoft.com/library/d...l/cpconPage.asp
Cheers,
Kris
> Is the use of "server transfer' just a bad idea for our type of
> application?
Yes and no. Everything has it's place but mostly you should avoid to use
Server.Transfer just because of those problems.
>Can we prevent or nullify Back/Refresh presses using javascript?
Afraid no. The user is in control and it's hard to prevent him doing that.
George.
"James Hunter Ross" <james.ross@.oneilsoft.com> wrote in message
news:%23H0blalNGHA.1288@.TK2MSFTNGP09.phx.gbl...
> Apparently, our developers used "server transfer" in our ASP.NET, and
> because of this Back/Refresh presses by users are problematic. Apparently
> the server has information about state and other things that the browser
> does not. The application could get very confused on Back/Refresh
> presses.
> Is the use of "server transfer' just a bad idea for our type of
> application?
> Can we prevent or nullify Back/Refresh presses using javascript? Bad
> idea?
> Any words or links will be greatly appreciated!
> James
Thus wrote James,
> Apparently, our developers used "server transfer" in our ASP.NET, and
> because of this Back/Refresh presses by users are problematic.
> Apparently the server has information about state and other things
> that the browser does not. The application could get very confused on
> Back/Refresh presses.
> Is the use of "server transfer' just a bad idea for our type of
> application? Can we prevent or nullify Back/Refresh presses using
> javascript? Bad idea?
Bad idea. Turn off scripting and... boom.
There's really just one way to fix this: Make your application immune against
these effects, like using Redirect-After-Post or applying synchronizer tokens
in your web forms.
Cheers,
--
Joerg Jooss
news-reply@.joergjooss.de
Thursday, March 22, 2012
Server.HtmlEncode fails with "Server is undefined"
In my application I need to allow users to cut 'n' paste stuff from
various sources, some of which might include dodgy characters such as
"<". Natch, IE interprets these as potentially dangerous and provides
a mechanism to encode/decode them. However I can't seem to get it to
work:
...
<asp:textbox id=txtDescription style="Z-INDEX: 102; LEFT: 111px;
POSITION: absolute; TOP: 124px" tabIndex=29 runat="server"
onblur="return ReplaceScriptCode()" Width="553px" Height="52px"
CssClass="STANDARD" Font-Names="Arial" Font-Size="8pt"
TextMode="MultiLine"></asp:textbox>
...
<script language="vb" runat=server>
Public Sub ReplaceScriptCode()
txtDescription.Text = Server.HtmlEncode(txtDescription.Text)
End Sub
</script>
The app. barfs, telling me that "Server is undefined". Thoughts?
Thanks
Edwardteddysnips@.hotmail.com wrote:
> In my application I need to allow users to cut 'n' paste stuff from
> various sources, some of which might include dodgy characters such as
> "<". Natch, IE interprets these as potentially dangerous and provides
> a mechanism to encode/decode them. However I can't seem to get it to
> work:
> ...
> <asp:textbox id=txtDescription style="Z-INDEX: 102; LEFT: 111px;
> POSITION: absolute; TOP: 124px" tabIndex=29 runat="server"
> onblur="return ReplaceScriptCode()" Width="553px" Height="52px"
> CssClass="STANDARD" Font-Names="Arial" Font-Size="8pt"
> TextMode="MultiLine"></asp:textbox>
> ...
> <script language="vb" runat=server>
> Public Sub ReplaceScriptCode()
> txtDescription.Text = Server.HtmlEncode(txtDescription.Text)
> End Sub
> </script>
> The app. barfs, telling me that "Server is undefined". Thoughts?
> Thanks
> Edward
>
You are mixing server code and client code. The code in the onblur event
doesn't call the VB subroutine that you have put in the server code, it
calls the client side function with the same name.
As you don't get the error message that ReplaceScriptCode is undefined,
I assume that you also have a Javascript or VBScript function with that
name?
If you have put the same code in that function as in your VB server side
subroutine, that will obviously not work, as there is no Server object
on the client side.
What is it that you are trying to do, really? There is nothing dangerous
about pasting markup code into a textbox. ASP.NET won't let you post
stuff that contains markup code to the server by default, but that is a
completely different thing, and has a completely different solution.
Gran Andersson
_____
http://www.guffa.com
Edward
I think your problem is that the OnBlur event, which is calling your
ReplaceScriptCode is a client side event, whereas the Server object is serve
r
side. The code works fine if executed from from code behind:
<asp:TextBox ID="txtDescription" Style="z-index: 102; left:
111px; position: absolute;
top: 124px" TabIndex="29" runat="server" onblur="return
ReplaceScriptCode()"
Width="553px" Height="52px" CssClass="STANDARD"
Font-Names="Arial" Font-Size="8pt"
TextMode="MultiLine"></asp:TextBox>
<script language="vb" runat="server">
Protected Overrides Sub OnLoad(ByVal e As System.EventArgs)
MyBase.OnLoad(e)
txtDescription.Text =
Server.HtmlEncode(txtDescription.Text)
End Sub
</script>
<asp:Button ID="Button1" runat="server" Text="Button" /></div>
Just hit the button to test it.
Hope this helps
Tom
"teddysnips@.hotmail.com" wrote:
> In my application I need to allow users to cut 'n' paste stuff from
> various sources, some of which might include dodgy characters such as
> "<". Natch, IE interprets these as potentially dangerous and provides
> a mechanism to encode/decode them. However I can't seem to get it to
> work:
> ...
> <asp:textbox id=txtDescription style="Z-INDEX: 102; LEFT: 111px;
> POSITION: absolute; TOP: 124px" tabIndex=29 runat="server"
> onblur="return ReplaceScriptCode()" Width="553px" Height="52px"
> CssClass="STANDARD" Font-Names="Arial" Font-Size="8pt"
> TextMode="MultiLine"></asp:textbox>
> ...
> <script language="vb" runat=server>
> Public Sub ReplaceScriptCode()
> txtDescription.Text = Server.HtmlEncode(txtDescription.Text)
> End Sub
> </script>
> The app. barfs, telling me that "Server is undefined". Thoughts?
> Thanks
> Edward
>
On 4 Jul, 12:09, G=F6ran Andersson <g...@.guffa.com> wrote:
> teddysn...@.hotmail.com wrote:
[=2E..]
> What is it that you are trying to do, really? There is nothing dangerous
> about pasting markup code into a textbox. ASP.NET won't let you post
> stuff that contains markup code to the server by default, but that is a
> completely different thing, and has a completely different solution.
As you say. The problem comes when the user tries to post the text
(dumb of me, I know, I should have mentioned that).
The user wants to be able to paste stuff into text boxes which is then
sent to the server for processing (generally, storage in a database
and later retrieval).
I don't want to remove validation at page level - in fact I doubt the
clients would let me. I rolled my own client-side jscript to strip
out markup code which was called from the OnBlur event, but I thought
I could improve on it using built-in functions.
In short, the requirement is:
ASP.NET with VB code behind.
User pastes stuff into an ASP TextBox
Presses "Save" button. Save button is asp:Button running server-side.
Remove/replace "dangerous" code with HtmlEncoded stuff and save to
database.
Thoughts?
Thanks,
Edward
teddysnips@.hotmail.com wrote:
> On 4 Jul, 12:09, Gran Andersson <g...@.guffa.com> wrote:
> [...]
> As you say. The problem comes when the user tries to post the text
> (dumb of me, I know, I should have mentioned that).
> The user wants to be able to paste stuff into text boxes which is then
> sent to the server for processing (generally, storage in a database
> and later retrieval).
> I don't want to remove validation at page level - in fact I doubt the
> clients would let me.
That validation is not required, as long as you make sure that you treat
the data as unvalidated on the server side. That means that you never
put it on a page or use it in a database query without making sure that
it's properly encoded.
As the validation doesn't cover any possible circumstances, that's what
you already should be doing anyway.
Read up on cross site scripting and sql injections, so that you know how
these types of security leaks can be exploited.
> I rolled my own client-side jscript to strip
> out markup code which was called from the OnBlur event, but I thought
> I could improve on it using built-in functions.
> In short, the requirement is:
> ASP.NET with VB code behind.
> User pastes stuff into an ASP TextBox
> Presses "Save" button. Save button is asp:Button running server-side.
> Remove/replace "dangerous" code with HtmlEncoded stuff and save to
> database.
> Thoughts?
Storing it html encoded in the database served no purpose. Html code can
not harm the database. You just have to make sure it isn't put on a page
without being encoded.
Gran Andersson
_____
http://www.guffa.com
On 4 Jul, 15:58, G=F6ran Andersson <g...@.guffa.com> wrote:
> teddysn...@.hotmail.com wrote:
us
[=2E..]
Thanks for all your help so far - it really is appreciated.
I reaslise that there's no danger to the database from the text, or
markup code (actually, in the scenario at present, it's simply users
copying and pasting e-mail messages wholesale, including the reply
prefixes e.g. >> as seen above which are the main problem). I just
want to allow the users to copy and paste what they want and save this
text to the database without incurring "A potentially dangerous
Request.Form value ... " error. So it seems to make sense to htlm-
encode the text, whatever it is, save it, and then un-html-encode it
when the data is retrieved and displayed.
I can't be the only person in history to have encountered this problem
yet I can't seem to find any examples that satisfy my requirements. I
thought this page:
http://www.asp.net/faq/RequestValidation.aspx#5
had it, but I can't make it work.
Any further ideas before you lose patience completely?
Edward
<teddysnips@.hotmail.com> wrote in message
news:1183563744.577845.215450@.m36g2000hse.googlegroups.com...
> Any further ideas before you lose patience completely?
Would something like this solve your problem:?
http://scriptasylum.com/tutorials/e...ode-decode.html
Mark Rae
ASP.NET MVP
http://www.markrae.net
teddysnips@.hotmail.com wrote:
> On 4 Jul, 15:58, Gran Andersson <g...@.guffa.com> wrote:
> [...]
> Thanks for all your help so far - it really is appreciated.
> I reaslise that there's no danger to the database from the text, or
> markup code (actually, in the scenario at present, it's simply users
> copying and pasting e-mail messages wholesale, including the reply
> prefixes e.g. >> as seen above which are the main problem). I just
> want to allow the users to copy and paste what they want and save this
> text to the database without incurring "A potentially dangerous
> Request.Form value ... " error. So it seems to make sense to htlm-
> encode the text, whatever it is, save it, and then un-html-encode it
> when the data is retrieved and displayed.
No, that doesn't make sense. Encoding only makes sense if you use an
encoding that is relevant for where you put the data. Html-encoding data
that goes into the database and then decode it when you read it is a
total waste of time, space and code. It serves no purpose at all.
Also, as you were trying to encode the text on the client side, that
doesn't make it any safer. On the contrary, as you would later decode
this text that you can't safely say that you know is properly encoded,
you would instead open up the security hole that the validation is meant
to help prevent.
> I can't be the only person in history to have encountered this problem
Of course not. I have handled the problem myself several times.
> yet I can't seem to find any examples that satisfy my requirements. I
> thought this page:
> http://www.asp.net/faq/RequestValidation.aspx#5
> had it, but I can't make it work.
Just pick that single property from that page and put in your @.Page
directive. That turns the validation off.
Then you just handle the data as normal, just store it in the database
at it is. When you later put it on a page, make sure that it's properly
html encoded.
Gran Andersson
_____
http://www.guffa.com
various sources, some of which might include dodgy characters such as
"<". Natch, IE interprets these as potentially dangerous and provides
a mechanism to encode/decode them. However I can't seem to get it to
work:
...
<asp:textbox id=txtDescription style="Z-INDEX: 102; LEFT: 111px;
POSITION: absolute; TOP: 124px" tabIndex=29 runat="server"
onblur="return ReplaceScriptCode()" Width="553px" Height="52px"
CssClass="STANDARD" Font-Names="Arial" Font-Size="8pt"
TextMode="MultiLine"></asp:textbox>
...
<script language="vb" runat=server>
Public Sub ReplaceScriptCode()
txtDescription.Text = Server.HtmlEncode(txtDescription.Text)
End Sub
</script>
The app. barfs, telling me that "Server is undefined". Thoughts?
Thanks
Edwardteddysnips@.hotmail.com wrote:
> In my application I need to allow users to cut 'n' paste stuff from
> various sources, some of which might include dodgy characters such as
> "<". Natch, IE interprets these as potentially dangerous and provides
> a mechanism to encode/decode them. However I can't seem to get it to
> work:
> ...
> <asp:textbox id=txtDescription style="Z-INDEX: 102; LEFT: 111px;
> POSITION: absolute; TOP: 124px" tabIndex=29 runat="server"
> onblur="return ReplaceScriptCode()" Width="553px" Height="52px"
> CssClass="STANDARD" Font-Names="Arial" Font-Size="8pt"
> TextMode="MultiLine"></asp:textbox>
> ...
> <script language="vb" runat=server>
> Public Sub ReplaceScriptCode()
> txtDescription.Text = Server.HtmlEncode(txtDescription.Text)
> End Sub
> </script>
> The app. barfs, telling me that "Server is undefined". Thoughts?
> Thanks
> Edward
>
You are mixing server code and client code. The code in the onblur event
doesn't call the VB subroutine that you have put in the server code, it
calls the client side function with the same name.
As you don't get the error message that ReplaceScriptCode is undefined,
I assume that you also have a Javascript or VBScript function with that
name?
If you have put the same code in that function as in your VB server side
subroutine, that will obviously not work, as there is no Server object
on the client side.
What is it that you are trying to do, really? There is nothing dangerous
about pasting markup code into a textbox. ASP.NET won't let you post
stuff that contains markup code to the server by default, but that is a
completely different thing, and has a completely different solution.
Gran Andersson
_____
http://www.guffa.com
Edward
I think your problem is that the OnBlur event, which is calling your
ReplaceScriptCode is a client side event, whereas the Server object is serve
r
side. The code works fine if executed from from code behind:
<asp:TextBox ID="txtDescription" Style="z-index: 102; left:
111px; position: absolute;
top: 124px" TabIndex="29" runat="server" onblur="return
ReplaceScriptCode()"
Width="553px" Height="52px" CssClass="STANDARD"
Font-Names="Arial" Font-Size="8pt"
TextMode="MultiLine"></asp:TextBox>
<script language="vb" runat="server">
Protected Overrides Sub OnLoad(ByVal e As System.EventArgs)
MyBase.OnLoad(e)
txtDescription.Text =
Server.HtmlEncode(txtDescription.Text)
End Sub
</script>
<asp:Button ID="Button1" runat="server" Text="Button" /></div>
Just hit the button to test it.
Hope this helps
Tom
"teddysnips@.hotmail.com" wrote:
> In my application I need to allow users to cut 'n' paste stuff from
> various sources, some of which might include dodgy characters such as
> "<". Natch, IE interprets these as potentially dangerous and provides
> a mechanism to encode/decode them. However I can't seem to get it to
> work:
> ...
> <asp:textbox id=txtDescription style="Z-INDEX: 102; LEFT: 111px;
> POSITION: absolute; TOP: 124px" tabIndex=29 runat="server"
> onblur="return ReplaceScriptCode()" Width="553px" Height="52px"
> CssClass="STANDARD" Font-Names="Arial" Font-Size="8pt"
> TextMode="MultiLine"></asp:textbox>
> ...
> <script language="vb" runat=server>
> Public Sub ReplaceScriptCode()
> txtDescription.Text = Server.HtmlEncode(txtDescription.Text)
> End Sub
> </script>
> The app. barfs, telling me that "Server is undefined". Thoughts?
> Thanks
> Edward
>
On 4 Jul, 12:09, G=F6ran Andersson <g...@.guffa.com> wrote:
> teddysn...@.hotmail.com wrote:
[=2E..]
> What is it that you are trying to do, really? There is nothing dangerous
> about pasting markup code into a textbox. ASP.NET won't let you post
> stuff that contains markup code to the server by default, but that is a
> completely different thing, and has a completely different solution.
As you say. The problem comes when the user tries to post the text
(dumb of me, I know, I should have mentioned that).
The user wants to be able to paste stuff into text boxes which is then
sent to the server for processing (generally, storage in a database
and later retrieval).
I don't want to remove validation at page level - in fact I doubt the
clients would let me. I rolled my own client-side jscript to strip
out markup code which was called from the OnBlur event, but I thought
I could improve on it using built-in functions.
In short, the requirement is:
ASP.NET with VB code behind.
User pastes stuff into an ASP TextBox
Presses "Save" button. Save button is asp:Button running server-side.
Remove/replace "dangerous" code with HtmlEncoded stuff and save to
database.
Thoughts?
Thanks,
Edward
teddysnips@.hotmail.com wrote:
> On 4 Jul, 12:09, Gran Andersson <g...@.guffa.com> wrote:
> [...]
> As you say. The problem comes when the user tries to post the text
> (dumb of me, I know, I should have mentioned that).
> The user wants to be able to paste stuff into text boxes which is then
> sent to the server for processing (generally, storage in a database
> and later retrieval).
> I don't want to remove validation at page level - in fact I doubt the
> clients would let me.
That validation is not required, as long as you make sure that you treat
the data as unvalidated on the server side. That means that you never
put it on a page or use it in a database query without making sure that
it's properly encoded.
As the validation doesn't cover any possible circumstances, that's what
you already should be doing anyway.
Read up on cross site scripting and sql injections, so that you know how
these types of security leaks can be exploited.
> I rolled my own client-side jscript to strip
> out markup code which was called from the OnBlur event, but I thought
> I could improve on it using built-in functions.
> In short, the requirement is:
> ASP.NET with VB code behind.
> User pastes stuff into an ASP TextBox
> Presses "Save" button. Save button is asp:Button running server-side.
> Remove/replace "dangerous" code with HtmlEncoded stuff and save to
> database.
> Thoughts?
Storing it html encoded in the database served no purpose. Html code can
not harm the database. You just have to make sure it isn't put on a page
without being encoded.
Gran Andersson
_____
http://www.guffa.com
On 4 Jul, 15:58, G=F6ran Andersson <g...@.guffa.com> wrote:
> teddysn...@.hotmail.com wrote:
us
[=2E..]
Thanks for all your help so far - it really is appreciated.
I reaslise that there's no danger to the database from the text, or
markup code (actually, in the scenario at present, it's simply users
copying and pasting e-mail messages wholesale, including the reply
prefixes e.g. >> as seen above which are the main problem). I just
want to allow the users to copy and paste what they want and save this
text to the database without incurring "A potentially dangerous
Request.Form value ... " error. So it seems to make sense to htlm-
encode the text, whatever it is, save it, and then un-html-encode it
when the data is retrieved and displayed.
I can't be the only person in history to have encountered this problem
yet I can't seem to find any examples that satisfy my requirements. I
thought this page:
http://www.asp.net/faq/RequestValidation.aspx#5
had it, but I can't make it work.
Any further ideas before you lose patience completely?
Edward
<teddysnips@.hotmail.com> wrote in message
news:1183563744.577845.215450@.m36g2000hse.googlegroups.com...
> Any further ideas before you lose patience completely?
Would something like this solve your problem:?
http://scriptasylum.com/tutorials/e...ode-decode.html
Mark Rae
ASP.NET MVP
http://www.markrae.net
teddysnips@.hotmail.com wrote:
> On 4 Jul, 15:58, Gran Andersson <g...@.guffa.com> wrote:
> [...]
> Thanks for all your help so far - it really is appreciated.
> I reaslise that there's no danger to the database from the text, or
> markup code (actually, in the scenario at present, it's simply users
> copying and pasting e-mail messages wholesale, including the reply
> prefixes e.g. >> as seen above which are the main problem). I just
> want to allow the users to copy and paste what they want and save this
> text to the database without incurring "A potentially dangerous
> Request.Form value ... " error. So it seems to make sense to htlm-
> encode the text, whatever it is, save it, and then un-html-encode it
> when the data is retrieved and displayed.
No, that doesn't make sense. Encoding only makes sense if you use an
encoding that is relevant for where you put the data. Html-encoding data
that goes into the database and then decode it when you read it is a
total waste of time, space and code. It serves no purpose at all.
Also, as you were trying to encode the text on the client side, that
doesn't make it any safer. On the contrary, as you would later decode
this text that you can't safely say that you know is properly encoded,
you would instead open up the security hole that the validation is meant
to help prevent.
> I can't be the only person in history to have encountered this problem
Of course not. I have handled the problem myself several times.
> yet I can't seem to find any examples that satisfy my requirements. I
> thought this page:
> http://www.asp.net/faq/RequestValidation.aspx#5
> had it, but I can't make it work.
Just pick that single property from that page and put in your @.Page
directive. That turns the validation off.
Then you just handle the data as normal, just store it in the database
at it is. When you later put it on a page, make sure that it's properly
html encoded.
Gran Andersson
_____
http://www.guffa.com
Server.HtmlEncode fails with "Server is undefined"
In my application I need to allow users to cut 'n' paste stuff from
various sources, some of which might include dodgy characters such as
"<". Natch, IE interprets these as potentially dangerous and provides
a mechanism to encode/decode them. However I can't seem to get it to
work:
You are mixing server code and client code. The code in the onblur event
doesn't call the VB subroutine that you have put in the server code, it
calls the client side function with the same name.
On 4 Jul, 12:09, Gran Andersson <g...@.guffa.comwrote:
[...]
As you say. The problem comes when the user tries to post the text
(dumb of me, I know, I should have mentioned that).
[...]
[...]
Would something like this solve your problem:?
http://scriptasylum.com/tutorials/e...ode-decode.html
--
Mark Rae
ASP.NET MVP
http://www.markrae.net
teddysnips@.hotmail.com wrote:
[...]
>
Thanks for all your help so far - it really is appreciated.
>
I reaslise that there's no danger to the database from the text, or
markup code (actually, in the scenario at present, it's simply users
copying and pasting e-mail messages wholesale, including the reply
prefixes e.g. >as seen above which are the main problem). I just
want to allow the users to copy and paste what they want and save this
text to the database without incurring "A potentially dangerous
Request.Form value ... " error. So it seems to make sense to htlm-
encode the text, whatever it is, save it, and then un-html-encode it
when the data is retrieved and displayed.
No, that doesn't make sense. Encoding only makes sense if you use an
encoding that is relevant for where you put the data. Html-encoding data
that goes into the database and then decode it when you read it is a
total waste of time, space and code. It serves no purpose at all.
Of course not. I have handled the problem myself several times.
Just pick that single property from that page and put in your @.Page
directive. That turns the validation off.
various sources, some of which might include dodgy characters such as
"<". Natch, IE interprets these as potentially dangerous and provides
a mechanism to encode/decode them. However I can't seem to get it to
work:
...
<asp:textbox id=txtDescription style="Z-INDEX: 102; LEFT: 111px;
POSITION: absolute; TOP: 124px" tabIndex=29 runat="server"
onblur="return ReplaceScriptCode()" Width="553px" Height="52px"
CssClass="STANDARD" Font-Names="Arial" Font-Size="8pt"
TextMode="MultiLine"></asp:textbox>
...
<script language="vb" runat=server>
Public Sub ReplaceScriptCode()
txtDescription.Text = Server.HtmlEncode(txtDescription.Text)
End Sub
</script>
The app. barfs, telling me that "Server is undefined". Thoughts?
Thanks
Edwardteddysnips@.hotmail.com wrote:
Quote:
Originally Posted by
In my application I need to allow users to cut 'n' paste stuff from
various sources, some of which might include dodgy characters such as
"<". Natch, IE interprets these as potentially dangerous and provides
a mechanism to encode/decode them. However I can't seem to get it to
work:
>
...
<asp:textbox id=txtDescription style="Z-INDEX: 102; LEFT: 111px;
POSITION: absolute; TOP: 124px" tabIndex=29 runat="server"
onblur="return ReplaceScriptCode()" Width="553px" Height="52px"
CssClass="STANDARD" Font-Names="Arial" Font-Size="8pt"
TextMode="MultiLine"></asp:textbox>
>
...
>
<script language="vb" runat=server>
Public Sub ReplaceScriptCode()
txtDescription.Text = Server.HtmlEncode(txtDescription.Text)
End Sub
</script>
>
The app. barfs, telling me that "Server is undefined". Thoughts?
>
Thanks
>
Edward
>
You are mixing server code and client code. The code in the onblur event
doesn't call the VB subroutine that you have put in the server code, it
calls the client side function with the same name.
As you don't get the error message that ReplaceScriptCode is undefined,
I assume that you also have a Javascript or VBScript function with that
name?
If you have put the same code in that function as in your VB server side
subroutine, that will obviously not work, as there is no Server object
on the client side.
What is it that you are trying to do, really? There is nothing dangerous
about pasting markup code into a textbox. ASP.NET won't let you post
stuff that contains markup code to the server by default, but that is a
completely different thing, and has a completely different solution.
--
Gran Andersson
_____
http://www.guffa.com
Edward
I think your problem is that the OnBlur event, which is calling your
ReplaceScriptCode is a client side event, whereas the Server object is server
side. The code works fine if executed from from code behind:
<asp:TextBox ID="txtDescription" Style="z-index: 102; left:
111px; position: absolute;
top: 124px" TabIndex="29" runat="server" onblur="return
ReplaceScriptCode()"
Width="553px" Height="52px" CssClass="STANDARD"
Font-Names="Arial" Font-Size="8pt"
TextMode="MultiLine"></asp:TextBox>
<script language="vb" runat="server">
Protected Overrides Sub OnLoad(ByVal e As System.EventArgs)
MyBase.OnLoad(e)
txtDescription.Text =
Server.HtmlEncode(txtDescription.Text)
End Sub
</script>
<asp:Button ID="Button1" runat="server" Text="Button" /></div>
Just hit the button to test it.
Hope this helps
Tom
"teddysnips@.hotmail.com" wrote:
Quote:
Originally Posted by
In my application I need to allow users to cut 'n' paste stuff from
various sources, some of which might include dodgy characters such as
"<". Natch, IE interprets these as potentially dangerous and provides
a mechanism to encode/decode them. However I can't seem to get it to
work:
>
...
<asp:textbox id=txtDescription style="Z-INDEX: 102; LEFT: 111px;
POSITION: absolute; TOP: 124px" tabIndex=29 runat="server"
onblur="return ReplaceScriptCode()" Width="553px" Height="52px"
CssClass="STANDARD" Font-Names="Arial" Font-Size="8pt"
TextMode="MultiLine"></asp:textbox>
>
...
>
<script language="vb" runat=server>
Public Sub ReplaceScriptCode()
txtDescription.Text = Server.HtmlEncode(txtDescription.Text)
End Sub
</script>
>
The app. barfs, telling me that "Server is undefined". Thoughts?
>
Thanks
>
Edward
>
>
On 4 Jul, 12:09, Gran Andersson <g...@.guffa.comwrote:
Quote:
Originally Posted by
teddysn...@.hotmail.com wrote:
[...]
Quote:
Originally Posted by
What is it that you are trying to do, really? There is nothing dangerous
about pasting markup code into a textbox. ASP.NET won't let you post
stuff that contains markup code to the server by default, but that is a
completely different thing, and has a completely different solution.
As you say. The problem comes when the user tries to post the text
(dumb of me, I know, I should have mentioned that).
The user wants to be able to paste stuff into text boxes which is then
sent to the server for processing (generally, storage in a database
and later retrieval).
I don't want to remove validation at page level - in fact I doubt the
clients would let me. I rolled my own client-side jscript to strip
out markup code which was called from the OnBlur event, but I thought
I could improve on it using built-in functions.
In short, the requirement is:
ASP.NET with VB code behind.
User pastes stuff into an ASP TextBox
Presses "Save" button. Save button is asp:Button running server-side.
Remove/replace "dangerous" code with HtmlEncoded stuff and save to
database.
Thoughts?
Thanks,
Edward
On 4 Jul, 15:58, Gran Andersson <g...@.guffa.comwrote:
Quote:
Originally Posted by
teddysn...@.hotmail.com wrote:
Quote:
Originally Posted by
On 4 Jul, 12:09, Gran Andersson <g...@.guffa.comwrote:
Quote:
Originally Posted by
teddysn...@.hotmail.com wrote:
[...]
Quote:
Originally Posted by
What is it that you are trying to do, really? There is nothing dangerous
about pasting markup code into a textbox. ASP.NET won't let you post
stuff that contains markup code to the server by default, but that is a
completely different thing, and has a completely different solution.
[...]
Thanks for all your help so far - it really is appreciated.
I reaslise that there's no danger to the database from the text, or
markup code (actually, in the scenario at present, it's simply users
copying and pasting e-mail messages wholesale, including the reply
prefixes e.g. >as seen above which are the main problem). I just
want to allow the users to copy and paste what they want and save this
text to the database without incurring "A potentially dangerous
Request.Form value ... " error. So it seems to make sense to htlm-
encode the text, whatever it is, save it, and then un-html-encode it
when the data is retrieved and displayed.
I can't be the only person in history to have encountered this problem
yet I can't seem to find any examples that satisfy my requirements. I
thought this page:
http://www.asp.net/faq/RequestValidation.aspx#5
had it, but I can't make it work.
Any further ideas before you lose patience completely?
Edward
<teddysnips@.hotmail.comwrote in message
news:1183563744.577845.215450@.m36g2000hse.googlegr oups.com...
Quote:
Originally Posted by
Any further ideas before you lose patience completely?
Would something like this solve your problem:?
http://scriptasylum.com/tutorials/e...ode-decode.html
--
Mark Rae
ASP.NET MVP
http://www.markrae.net
teddysnips@.hotmail.com wrote:
Quote:
Originally Posted by
On 4 Jul, 15:58, Gran Andersson <g...@.guffa.comwrote:
Quote:
Originally Posted by
>teddysn...@.hotmail.com wrote:
Quote:
Originally Posted by
>>On 4 Jul, 12:09, Gran Andersson <g...@.guffa.comwrote:
>>>teddysn...@.hotmail.com wrote:
>>[...]
>>>What is it that you are trying to do, really? There is nothing dangerous
>>>about pasting markup code into a textbox. ASP.NET won't let you post
>>>stuff that contains markup code to the server by default, but that is a
>>>completely different thing, and has a completely different solution.
[...]
>
Thanks for all your help so far - it really is appreciated.
>
I reaslise that there's no danger to the database from the text, or
markup code (actually, in the scenario at present, it's simply users
copying and pasting e-mail messages wholesale, including the reply
prefixes e.g. >as seen above which are the main problem). I just
want to allow the users to copy and paste what they want and save this
text to the database without incurring "A potentially dangerous
Request.Form value ... " error. So it seems to make sense to htlm-
encode the text, whatever it is, save it, and then un-html-encode it
when the data is retrieved and displayed.
No, that doesn't make sense. Encoding only makes sense if you use an
encoding that is relevant for where you put the data. Html-encoding data
that goes into the database and then decode it when you read it is a
total waste of time, space and code. It serves no purpose at all.
Also, as you were trying to encode the text on the client side, that
doesn't make it any safer. On the contrary, as you would later decode
this text that you can't safely say that you know is properly encoded,
you would instead open up the security hole that the validation is meant
to help prevent.
Quote:
Originally Posted by
I can't be the only person in history to have encountered this problem
Of course not. I have handled the problem myself several times.
Quote:
Originally Posted by
yet I can't seem to find any examples that satisfy my requirements. I
thought this page:
>
http://www.asp.net/faq/RequestValidation.aspx#5
>
had it, but I can't make it work.
Just pick that single property from that page and put in your @.Page
directive. That turns the validation off.
Then you just handle the data as normal, just store it in the database
at it is. When you later put it on a page, make sure that it's properly
html encoded.
--
Gran Andersson
_____
http://www.guffa.com
Subscribe to:
Posts (Atom)