Asp Tags

Have I Come to the Right Place?

[inuwolf]

Hi,

I only recently got administrative powers over some forums scripted in ASP. Although we allow users to apply E-tags (a dumbed-down version of HTML tags) to their posts, somehow the users are putting tags in their member names that disrupt the ASP. The member names are printed from ASP to HTML and they link to the member's profile, but somehow new users are also making names with scripted objects like images in them.

I realize I could restrict the use of certain characters in member names to prevent scripting, but before I do that I'd like to know what kind of tags these people are using. How can they script right through what should be text?

Thanks,

I appreciate all the help I've gotten at WW

[Krapulator]

Could you use server.htmlencode to prevent this problem?

[inuwolf]

I could and I probably will, but I'm still interested in what tags can be used to cause this kind of disruption. I guess this question is motivated more by curiosity than pragmatism.

[Krapulator]

If you have access to the db that the forum is running from, you could have a look and see what has actually been uploaded.

[inuwolf]

Good you brought that up, Krapulator (haha); I haven't made myself clear enough.

Although I can control the parameters of the DB (limiting what is let into it), I can't actually see what's inside.

I ask you what tags might have been used, because although I know tags are being used and I know how to stop them, I can't see them, but I'd still like to have an idea as to what they are.

[g1smd]

Why doesn't "view source" on the page show them to you?

[inuwolf]

Good question. Because only some of the ASP code prints to the browser, it's easy to hide the tags, so I can't see them.

[inuwolf]

Have I Come to the Right Place?

...apparently not. Is there an ASP forum here?

[g1smd]

Over there... [webmasterworld.com...]