Forum Moderators: open
<html>
<head>
<title>Update Employee Records</title>
</head>
<body>
<%
'Dimension Local variables
Dim objRS
set oConn=Server.CreateObject("ADODB.Connection")
oConn.Provider="Microsoft.Jet.OLEDB.4.0"
oConn.Open(Server.Mappath("OfficeDB.mdb"))
%>
<form name="form1" method="post" action="SelectEmployee.asp">
Employee ID: <INPUT id=text1 name=text1 size="10">
<input type="submit" name="Submit" value="Go">
<select name="Employee_Id">
<%
strId = Request.Form("text1")
If Request.Form("Submit") = "go" Then
set rs=Server.CreateObject("ADODB.Recordset")
sql="SELECT * FROM Employee WHERE Emp_Id LIKE '%&strId&' "
rs.Open sql,oConn
do until rs.EOF
response.write("<option")
if rs.fields("Emp_Id")= strId then
response.write("selected")
end if
response.write(">")
response.write(rs.fields("Emp_Id"))
rs.MoveNext
loop
rs.Close
set rs=Nothing
End If
%>
</select>
</form>
</body>
</html>
...
<form name="form1" method="post" action="SelectEmployee.asp">
Employee ID: <INPUT id=text1 name=text1 size="10">
[b]<input type="submit" value="Go">[/b]
<select name="Employee_Id">
<%
strId = [b]Trim(Request.Form("text1")&"")[/b]
If [b](strId <> "")[/b] Then
...
-=casey=-
Instead of:
If Request.Form("Submit") = "go" Then
Do:
If Request.Form.Count > 0 Then
So say a user enters this into text1:
' select * from sysusers --
Your query would be adjusted to this:
SELECT * FROM Employee WHERE Emp_Id LIKE '%&' select * from sysusers -- ' strId&'
Or worse what if they pass in an endless loop?
<%
For each x in Request.Form
Response.Write x & ": " & Request.Form(x) & "<br>"
Next
Response.Write "<br><br>"
Response.Write "Form Button Value -->" & REquest.Form("go")
%>
<form name="test" method="post">
<input type="text" name="a"><input type="submit" name="go" value="go">
</form>
SELECT * FROM Employee WHERE Emp_Id LIKE '%&' select * from sysusers -- ' strId&'
Throw an error...
Security concern is healthy, paranoia isn't.
sql="SELECT * FROM Employee WHERE Emp_Id LIKE '%&strId&' "
should be
sql="SELECT * FROM Employee WHERE Emp_Id LIKE '% " & strId & " '"
My take is that a user could execute queries w/o your knowledge and therefore impact your performance. I'm not saying that the results of the second query would be displayed. It's obvious that they won't.
This code illustrates that the 2nd query executes when passing in ' select * from sysusers --
strId = Request.Form("text1")
sql="SELECT * FROM Employee WHERE Emp_Id LIKE '% " & strId & " '"
Set oCNN = Server.CreateObject("adodb.connection")
oCNN.Open Application("DB_CONN_STRING")
Set oRST = Server.CreateObject("adodb.recordset")
With oRST
.Open sql, oCNN, adOpenForwardOnly, adLockReadOnly
If Not .EOF Then
aItems = .GetRows()
Else
aItems = Null
End If
End With
Set rs2 = oRST.NextRecordset
aItems2 = rs2.GetRows()
For i = lbound(aItems2,2) To ubound(aItems2,2)
Response.Write (aItems2(0,i)) & "<br>"
Next
sql="SELECT * FROM Employee WHERE Emp_Id LIKE '%" & Replace(strId, "'", "''") & "'"
This way you won't get an error when someone enters a quote, which is good practice anyway, and it also prevents anything undesired being executed.
