preventing malicious user input

[Stimp]

I have an input field, which will ultimately be stored in a database
and the contents of which will be output on screen at some stage.

ASP.NET has built-in functionality to prevent users inputing values
such as "<script>", etc, to call malicious code, but I'd prefer to back
this up with my own input validation.

I'll deny < and > characters on input.. any other
strings/characters to look for?

Thanks!
--

"I hear ma train a comin'
.... hear freedom comin"

[Mark]

What about using parameters?
Would that lessen the risk?
"Cowboy (Gregory A. Beamer) - MVP" <No************ @comcast.netNoS pamM> wrote
in message news:5B******** *************** ***********@mic rosoft.com...

I would read this article for a good idea of what hackers might try to do to your database.

http://msdn.microsoft.com/msdnmag/is...n/default.aspx

For validation, each data type has different needs, so I do not have a list of best practices for every situation.

---

Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

*************** ************
Think Outside the Box!
*************** ************

"Stimp" wrote:

I have an input field, which will ultimately be stored in a database
and the contents of which will be output on screen at some stage.

ASP.NET has built-in functionality to prevent users inputing values
such as "<script>", etc, to call malicious code, but I'd prefer to back
this up with my own input validation.

I'll deny < and > characters on input.. any other
strings/characters to look for?

Thanks!
--

"I hear ma train a comin'
.... hear freedom comin"