Can Classic ASP talk to C/C++?

[tanya.wang]

I have a system written in classic asp and a lot of Javascript. Due to
its performance and security issue, we decided to re-write this big
module. I heard that C/C++ has a better support in performance and
security (relatively) but here comes my questions:

1. Can ASP talk to C/C++? Because from my experience I use C/C++
mainly for application console.

2. If I want to exclude most of the Javascript and use other
programming language instead, can ASP.NET do it? Is there any
compatibility issue between Classic ASP/ASP.NET/Javascript?

Thank you for reading this.

[Anthony Jones]

<ta********@gmail.comwrote in message
news:11**********************@o61g2000hsh.googlegr oups.com...

>
I have a system written in classic asp and a lot of Javascript. Due to
its performance and security issue, we decided to re-write this big
module. I heard that C/C++ has a better support in performance and
security (relatively) but here comes my questions:

1. Can ASP talk to C/C++? Because from my experience I use C/C++
mainly for application console.

Through a COM interface yes. If you are truely are comfortable with C++
then its viable but only if you're a seasoned C++ developer. Otherwise
avoid this.

2. If I want to exclude most of the Javascript and use other
programming language instead, can ASP.NET do it? Is there any
compatibility issue between Classic ASP/ASP.NET/Javascript?

ASP and ASP.NET are very different things whilst its possible to coexist ASP
with ASP.NET the are significant hurdles to overcome when trying to port a
portion of an existing ASP app to ASP.NET. You could consider a complete
re-write to ASP.NET.

However possibly you are thinking of creating components to protect your IP,
..NET isn't great at that but is better then having all your code in open
script. You can do this with COM Interop layer to allo ASP code you access
..NET built components.

Whats the nature of your performance problems?

>
Thank you for reading this.

[Bob Barrows [MVP]]

Bob Barrows [MVP] wrote:

ta********@gmail.com wrote:

>Thank you Anthony and Bob, I appreciate your opinion. :)

Let me elaborate more about my previous questions. The system that I
was asking is more like an instant note sending system only available
to our website members. The core is written in ASP/Javascript and it
could be included in any of our webpages when it's required for the
development. The security issue is because 50% of it was written in
Javascript, and it's visible when one choose to view source in the
browser, some people begin putting some malicious codes inside the
subject/content and thereby attempting to hack our system.

This sounds as if you are using dynamic sql to handle he user input.
As you are finding out this is a bad idea. You need to implement a
two-phase approach:
1. Validate all user input in server-side code. Do not depend on
client-side validation. If possible, identify malicious input and
kick the maliciouls users out of the system
2. Use parameters instead of dynamic sql

Here are some links about sql injection

Oops

http://mvp.unixwiz.net/techtips/sql-injection.html
http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23
http://www.nextgenss.com/papers/adva..._injection.pdf
http://www.nextgenss.com/papers/more..._injection.pdf

See here for a better, more secure way to execute your queries by using
parameter markers:
http://groups-beta.google.com/group/...e36562fee7804e

Personally, I prefer using stored procedures
http://groups.google.com/group/micro...fedf4e1efd63a6

And if you are using dynamic sql inside your stored procedure:
http://www.sommarskog.se/dynamic_sql.html

--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"

[Evertjan.]

wrote on 29 jun 2007 in microsoft.public.inetserver.asp.general:

The core is written in ASP/Javascript and it
could be included in any of our webpages when it's required for the
development. The security issue is because 50% of it was written in
Javascript, and it's visible when one choose to view source in the
browser, ....

Despite the warnings given, you are still using the wrong terminology,
using the word "javascript" for "clientside javascript", while most readers
of this NG will understand "ASP/javascript" as "serverside javascript under
ASP".

In the same way, ASP itself being just a platform, the term ASP needs
elaboration on the serverside language used, and ASP does NOT stand for
"ASP vbscript" as such.

Using clientside javascript as part of any security scheme is a wrong
aproach, period. Clientside javascript should only be used for dynamic
features and for giving the user a helping hand on a [perhaps ASP
serverside language rendered] html page.
--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[tanya.wang]

Sorry for my late reply...

I have checked the schema of my notes table.

There is a primary key clustered on noteid with fillfactor=90 on
primary.
A FK to check if the receiver exists in our member table. on delete
cascade and on update cascade.
Three default constraints indicating note type, create date, and if
this note has been read.
No DB triggers associated with this table.

I wrote a sp "Add_Notes_sp " to insert into data whenever it's been
called for sending notes.
On my asp page, I simply called
conn.execute "Add_Notes_sp " & parameter1 & "," & parameter 2 & ...

If the fundamental problem results from the SQL server and DB schema,
then I would understand why it's no help to re-write in C++. If I took
the right idea - the system should be still slow since I still need to
call DB and sp after the rewrite.

Thank you very much for all your suggestions. I really appreciate
that.

[Evertjan.]

wrote on 03 jul 2007 in microsoft.public.inetserver.asp.general:

Sorry for my late reply...

A reply?

This is usenet and not email,
and if you do not quote,
as is rightly required by Netiquette,
how are we to know what you are going on about?

Even a prompt reply would need some quoting.

I have checked the schema of my notes table.

There is a primary key clustered on noteid with fillfactor=90 on
primary.
A FK to check if the receiver exists in our member table. on delete
cascade and on update cascade.
Three default constraints indicating note type, create date, and if
this note has been read.
No DB triggers associated with this table.

I wrote a sp "Add_Notes_sp " to insert into data whenever it's been
called for sending notes.
On my asp page, I simply called
conn.execute "Add_Notes_sp " & parameter1 & "," & parameter 2 & ...

If the fundamental problem results from the SQL server and DB schema,
then I would understand why it's no help to re-write in C++. If I took
the right idea - the system should be still slow since I still need to
call DB and sp after the rewrite.

Thank you very much for all your suggestions. I really appreciate
that.

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[Mark J. McGinty]

Since most of us likely use Usenet clients that maintain the context of
ongoing threads, I'd think quoting to be pretty much a non-issue to all but
the most anal-retentive of us.

Isn't there anything in netiquette about posting to the Usenet for the sole
purpose of making a point about netiquette? If not, I'd call it a miserable
failure on the part of whomever its collective authors are, because posting
something that is 100% admonition and 0% content is perhaps the rudest thing
that happens here.

(To the OP, pay no mind to the 'netiquette police', his views are mostly his
own, and even if any are widely shared, no one else goes out of their way to
promote them.)
-Mark
"Evertjan." <ex**************@interxnl.netwrote in message
news:Xn********************@194.109.133.242...

wrote on 03 jul 2007 in microsoft.public.inetserver.asp.general:

>Sorry for my late reply...

A reply?

This is usenet and not email,
and if you do not quote,
as is rightly required by Netiquette,
how are we to know what you are going on about?

Even a prompt reply would need some quoting.

>I have checked the schema of my notes table.

There is a primary key clustered on noteid with fillfactor=90 on
primary.
A FK to check if the receiver exists in our member table. on delete
cascade and on update cascade.
Three default constraints indicating note type, create date, and if
this note has been read.
No DB triggers associated with this table.

I wrote a sp "Add_Notes_sp " to insert into data whenever it's been
called for sending notes.
On my asp page, I simply called
conn.execute "Add_Notes_sp " & parameter1 & "," & parameter 2 & ...

If the fundamental problem results from the SQL server and DB schema,
then I would understand why it's no help to re-write in C++. If I took
the right idea - the system should be still slow since I still need to
call DB and sp after the rewrite.

Thank you very much for all your suggestions. I really appreciate
that.

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[Evertjan.]

Mark J. McGinty wrote on 04 jul 2007 in
microsoft.public.inetserver.asp.general:

Since most of us likely use Usenet clients that maintain the context
of ongoing threads, I'd think quoting to be pretty much a non-issue to
all but the most anal-retentive of us.

Did you do a survey or do you define "most of us"
as the people that likely follow your idea's, Mark?

"anal-retentive of us"

Is this the preferred vocabulary on usenet-as-you-see-it?

Do you hink that an argument should be won
by degrading others with words like that.

If so, I pity you.

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)