|
WebApp Sec
mailing list archives
Web Forms filtered with SQL constraints
From: Bénoni MARTIN <Benoni.MARTIN () libertis ga>
Date: Tue, 5 Oct 2004 13:25:50 +0100
Hi list !
I was wondering how to solve the 2 following problems: I have ASP (not ASP.NET) formulaires people have to fill in. To
avoid SQ injection attacks and other tricks, I have set up some Jscript filtering on each field (i.e. for instance a
name can just be alphabet's characters and no figures :) ), and I am planning to do the same on my Database (setting up
constraints).
But I have 2 questions:
- How can I hide my Jscript filtering from the user ? When I want to see the source, everything is diaplayed,
quite normal :( ... Maybe it's not so good to tell people what I have done to filter them :) I saw some sites where it
is impossible to see the source, impossible to "hoover the site", impossible even to print ... But I have not been able
to find on the net how to do this :(
- How can I deal with possible SQL errors within an ASP page ? I mean, if a field has been filled in, bypass my
Jscript filtering (no matter how), and gets to the database but is then "stopped" by an SQL onstraint, how do I raise
this error on an ASP page without diplaying an explicit error (giving the user the name of my database for instance) ?
Cheers for any clue, I am lost on this topic :(
By Date
By Thread
Current thread:
- Web Forms filtered with SQL constraints Bénoni MARTIN (Oct 05)
|