473,243 Members | 1,600 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,243 software developers and data experts.

Disabling SS Scripting on submit

I was hired to make a Content Management System for a computer
consulting group, and it is almost done. It allows registered users
to submit code that is dynamically inserted into the Live website. It
works, BUT!

I only want CLIENT-SIDE code to be allowed for submission.

Can you give me some ideas as to what I should DIS-allow on submit?
First I will parse the submission using Javascript, and then I will
re-parse with ASP before I allow stuff to be inserted.

Here is my "lack List"so far... Disallow:

1. <%
2. %>
3. HTMLEncode
4. runat

Do you have some other ideas? I am sure other Server-Side scripting
technologies (like PHP and PERL) must use there own ways of doing
stuff, and I bet even in ASP I am forgetting a couple things...

Any help is appreciated.

Thanks,
Holden
PS: The "HTMLEncode" is for stuff like this:
Server.HTMLEncode( string )
PPS: The "runat" is to disallow stuff like this:
<script language="vbscript" runat="server">
Jul 19 '05 #1
3 1229
What does "dynamically inserted" mean? Do you inject this code directly
into a static ASP file? If you store it in a database and retrieve it at
run time, or insert it into an HTML code, it should work fine, and just be
ignored.

--
Aaron Bertrand
SQL Server MVP
http://www.aspfaq.com/


"Holden Caulfield" <co***********@hotmail.com> wrote in message
news:6d**************************@posting.google.c om...
I was hired to make a Content Management System for a computer
consulting group, and it is almost done. It allows registered users
to submit code that is dynamically inserted into the Live website. It
works, BUT!

I only want CLIENT-SIDE code to be allowed for submission.

Can you give me some ideas as to what I should DIS-allow on submit?
First I will parse the submission using Javascript, and then I will
re-parse with ASP before I allow stuff to be inserted.

Here is my "lack List"so far... Disallow:

1. <%
2. %>
3. HTMLEncode
4. runat

Do you have some other ideas? I am sure other Server-Side scripting
technologies (like PHP and PERL) must use there own ways of doing
stuff, and I bet even in ASP I am forgetting a couple things...

Any help is appreciated.

Thanks,
Holden
PS: The "HTMLEncode" is for stuff like this:
Server.HTMLEncode( string )
PPS: The "runat" is to disallow stuff like this:
<script language="vbscript" runat="server">

Jul 19 '05 #2
"Holden Caulfield" <co***********@hotmail.com> wrote in message
news:6d**************************@posting.google.c om...
I was hired to make a Content Management System for a computer
consulting group, and it is almost done. It allows registered users
to submit code that is dynamically inserted into the Live website. It
works, BUT!

I only want CLIENT-SIDE code to be allowed for submission.

Can you give me some ideas as to what I should DIS-allow on submit?
First I will parse the submission using Javascript, and then I will
re-parse with ASP before I allow stuff to be inserted.

Here is my "lack List"so far... Disallow:

1. <%
2. %>
3. HTMLEncode
4. runat

Do you have some other ideas? I am sure other Server-Side scripting
technologies (like PHP and PERL) must use there own ways of doing
stuff, and I bet even in ASP I am forgetting a couple things...

Any help is appreciated.

Thanks,
Holden
PS: The "HTMLEncode" is for stuff like this:
Server.HTMLEncode( string )
PPS: The "runat" is to disallow stuff like this:
<script language="vbscript" runat="server">


I can see why items 1, 2, and 4 would be disallowed... but why HTMLEncode?
HTMLEncode is part of the Server object... if you are not allowing <% then
HTMLEncode could never be executed, so this is redundant. I would get rid
of it.

You might consider disallowing server side include tags as well, though I'm
not sure how easy or difficult that would be. And perhaps "<?", "?>", and
"<!".

I guess it depends on how much control you want them to have. For example,
could they include </html> in their text, thus ending the page prematurely?

Regards,
Peter Foti

Jul 19 '05 #3
Thanks for the replies. By "dynamically inserted" I just mean that
users can edit the live site.

I can see why items 1, 2, and 4 would be disallowed... but why HTMLEncode?
HTMLEncode is part of the Server object... if you are not allowing <% then
HTMLEncode could never be executed, so this is redundant.
Point taken, Thanks!
You might consider disallowing server side include tags as well, though I'm
not sure how easy or difficult that would be. And perhaps "<?", "?>", and
The SS Includes is a great idea! Thanks. And the delimiters ("<?",
"?>") are great too, although I am unfamiliar with them...
I guess it depends on how much control you want them to have. For example,
could they include </html> in their text, thus ending the page prematurely?


I want to allow ANY client-side code, even if it is dumb. I want to
eliminate ALL server-side code.

Thanks for the ideas! Anyone else have anything to add?

Holden
Jul 19 '05 #4

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

16
by: Ralph Freshour | last post by:
How can I disable a button once it has been clicked? I want to prevent the user from clicking on it twice if they have a slow connection. Thanks...
4
by: omidmottaghi | last post by:
I need to disable/enable form elements in my form. the code i was developed works fine in FF, but in IE, its behaviour is very strange!! in the form, we have a lot of checkboxes, all of them...
2
by: Jeelz | last post by:
Hi Guyz, Would appriciate any tip on disabling an ASP.NET LinkButton using client sided code like javascript. My Requirement is such that the user should be allowed to click on the link...
3
by: Mark | last post by:
This is a solution... Often users want to keep clicking "submit" when they are waiting for server processing. Most apps these days like to disable the submit button to prevent this. You can't just...
7
by: John Meyer | last post by:
I have a program where I have to enable or disable a list box based upon a radio button. Is there an "enabled" property on select boxes?
5
by: Joja | last post by:
I have form with one submit button. All i want to create is to allow user to make JUST ONE button click. After that click, button will be still displayed but it will be disabled. How to make this ?
8
by: Willie | last post by:
Hi All; I have a form with multiple buttons and I would like to disable the buttons after the user clicks on the button to prevent multiple submitions. <input type="submit" name="return1"...
9
by: poml | last post by:
Hello, first time posting on thescripts.com, and I'm in dire need of some help. All I want to do is disable the submit button (not the entire form) onClick, and am wondering if this is possible. ...
1
by: arggg | last post by:
I created a submit form that calls a javascript:AjAX Command that will call the data and submit it without have the page refresh. This works perfect in Firefox however in IE and Opera when the...
0
by: abbasky | last post by:
### Vandf component communication method one: data sharing ​ Vandf components can achieve data exchange through data sharing, state sharing, events, and other methods. Vandf's data exchange method...
0
by: stefan129 | last post by:
Hey forum members, I'm exploring options for SSL certificates for multiple domains. Has anyone had experience with multi-domain SSL certificates? Any recommendations on reliable providers or specific...
0
Git
by: egorbl4 | last post by:
Скачал я git, хотел начать настройку, а там вылезло вот это Что это? Что мне с этим делать? ...
1
by: davi5007 | last post by:
Hi, Basically, I am trying to automate a field named TraceabilityNo into a web page from an access form. I've got the serial held in the variable strSearchString. How can I get this into the...
0
by: MeoLessi9 | last post by:
I have VirtualBox installed on Windows 11 and now I would like to install Kali on a virtual machine. However, on the official website, I see two options: "Installer images" and "Virtual machines"....
0
by: DolphinDB | last post by:
Tired of spending countless mintues downsampling your data? Look no further! In this article, you’ll learn how to efficiently downsample 6.48 billion high-frequency records to 61 million...
0
by: Aftab Ahmad | last post by:
So, I have written a code for a cmd called "Send WhatsApp Message" to open and send WhatsApp messaage. The code is given below. Dim IE As Object Set IE =...
0
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...
0
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.