Re: Displaying User-Supplied String

Hello Mark Rae [MVP],

"Jonathan Wood" <jwood@xxxxxxxxxxxxxxxx> wrote in message
news:OqKJvmgBIHA.5868@xxxxxxxxxxxxxxxxxxxxxxx

Okay, I have a site that displays information based on user input, a
couple of the items are plain strings that the user entered.

I understand the risk here is that they could insert javascript or
whatever in their string and, when my page displays it, that script
could be executed.

What is the best approach for preventing that?

Are you talking about SQL Injection i.e. the strings supplied by the
users are used to look up records in a database?

If so, you need to use parameterised queries or stored procedures.

Google "SQL injection"

There's more than SQL injection at work here. apart from SQL injection there is the risk of cross site scripting as the original poster correctly identified. Best way to prevent that is to call Server.HTMLEncode on each field before displaying it. I usually don't encode the data before putting it into the database as the data migth be used in a non-web environment as well (reporting, windows client etc).

So encode before displaying.

--
Jesse Houwing
jesse.houwing at sogeti.nl


.

Relevant Pages

  • Re: Displaying User-Supplied String
    ... Are you talking about SQL Injection i.e. the strings supplied by the ... I usually don't encode the data before putting it into the database as the data migth be used in a non-web environment as well ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Displaying User-Supplied String
    ... "Jesse Houwing" wrote in message ... Are you talking about SQL Injection i.e. the strings supplied by the ... encode the data before putting it into the database as the data migth ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Displaying User-Supplied String
    ... couple of the items are plain strings that the user entered. ... I understand the risk here is that they could insert javascript or whatever in their string and, when my page displays it, that script could be executed. ... Are you talking about SQL Injection i.e. the strings supplied by the users are used to look up records in a database? ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: PHP filter function against SQL injections
    ... If you're using strings you should also decode them from embedded url encoded data with urldecodee.g., ... If you're accepting a string, for example, only allow valid characters to be placed in the form field. ... but since this filter function is part of a review I'm doing at the moment, I was asking the question about a possible SQL injection attack. ...
    (Security-Basics)
  • Re: Displaying User-Supplied String
    ... Request.Form value was detected from the client ... Are you talking about SQL Injection i.e. the strings supplied by the ... Jesse Houwing ...
    (microsoft.public.dotnet.framework.aspnet)