Dear all,
I have read that ASP.NET does double user input validation of control when
they are place on the page. Once on teh client side and again from server
side right ?
Could explain how this process is exaclty working ?
regards
thnaks for your help
Serge
6  1438 
Serge,
All of the .NET validators attempt to validate each control client-side in
order to save a trip to the server. This is done so that the user experience
is faster whenever possible. However, no client-side only validation is
secure because the server should never trust what the client is sending it.
So the data is again validated server side. Validation server side may be
checked by wrapping any code that will be using the input in question with
something along the lines of:
If Page.IsValid Then
'---input is valid run code here
End If
If the code isn't valid the validator's automatically display error
messages. This two tier system allows client machines capable of running the
validation javascripts better the user experience, but still makes certain
that input is valid and that browsers without the client-side validation
capabilities still have the same (albeit slower) validation experience.
--
Sincerely,
S. Justin Gengo, MCP
Web Developer / Programmer www.aboutfortunate.com
"Out of chaos comes order."
Nietzsche
"serge calderara" <se************ @discussions.mi crosoft.com> wrote in
message news:F9******** *************** ***********@mic rosoft.com... Dear all,
I have read that ASP.NET does double user input validation of control when
they are place on the page. Once on teh client side and again from server
side right ?
Could explain how this process is exaclty working ?
regards
thnaks for your help
Serge
Thnaks for your reply
Have you heard about those spaming method of hacker which make you feel that
your are on your bank home page but in fact its there own in order to
collects data or destroy your system....
Does this ASP cross check validation on client and server side can prevent
from such thing happen ?
"S. Justin Gengo" wrote: Serge,
All of the .NET validators attempt to validate each control client-side in
order to save a trip to the server. This is done so that the user experience
is faster whenever possible. However, no client-side only validation is
secure because the server should never trust what the client is sending it.
So the data is again validated server side. Validation server side may be
checked by wrapping any code that will be using the input in question with
something along the lines of:
If Page.IsValid Then
'---input is valid run code here
End If
If the code isn't valid the validator's automatically display error
messages. This two tier system allows client machines capable of running the
validation javascripts better the user experience, but still makes certain
that input is valid and that browsers without the client-side validation
capabilities still have the same (albeit slower) validation experience.
--
Sincerely,
S. Justin Gengo, MCP
Web Developer / Programmer
www.aboutfortunate.com
"Out of chaos comes order."
Nietzsche
"serge calderara" <se************ @discussions.mi crosoft.com> wrote in
message news:F9******** *************** ***********@mic rosoft.com... Dear all,
I have read that ASP.NET does double user input validation of control when
they are place on the page. Once on teh client side and again from server
side right ?
Could explain how this process is exaclty working ?
regards
thnaks for your help
Serge
Serge,
I assume you are referring to what is commonly known as cross site scripting
or XSS. Yes the validators are one line of defense against this. For example
if your page is allowing a number to input you should use a
CompareValidato r. If you set the CompareValidato r's Operator property to:
DataTypeCheck you can then set it's Type property to String, Integer,
Double, etc. For the example I'm giving you would set it to integer and then
nothing but an integer would be able to be submitted to the page. This would
stop an XSS attack.
--
Sincerely,
S. Justin Gengo, MCP
Web Developer / Programmer www.aboutfortunate.com
"Out of chaos comes order."
Nietzsche
"serge calderara" <se************ @discussions.mi crosoft.com> wrote in
message news:46******** *************** ***********@mic rosoft.com... Thnaks for your reply
Have you heard about those spaming method of hacker which make you feel
that
your are on your bank home page but in fact its there own in order to
collects data or destroy your system....
Does this ASP cross check validation on client and server side can prevent
from such thing happen ?
"S. Justin Gengo" wrote:
Serge,
All of the .NET validators attempt to validate each control client-side
in
order to save a trip to the server. This is done so that the user
experience
is faster whenever possible. However, no client-side only validation is
secure because the server should never trust what the client is sending
it.
So the data is again validated server side. Validation server side may be
checked by wrapping any code that will be using the input in question
with
something along the lines of:
If Page.IsValid Then
'---input is valid run code here
End If
If the code isn't valid the validator's automatically display error
messages. This two tier system allows client machines capable of running
the
validation javascripts better the user experience, but still makes
certain
that input is valid and that browsers without the client-side validation
capabilities still have the same (albeit slower) validation experience.
--
Sincerely,
S. Justin Gengo, MCP
Web Developer / Programmer
www.aboutfortunate.com
"Out of chaos comes order."
Nietzsche
"serge calderara" <se************ @discussions.mi crosoft.com> wrote in
message news:F9******** *************** ***********@mic rosoft.com... > Dear all,
>
> I have read that ASP.NET does double user input validation of control
> when
> they are place on the page. Once on teh client side and again from
> server
> side right ?
>
> Could explain how this process is exaclty working ?
>
> regards
> thnaks for your help
> Serge
Serge,
Here's a good article on Cross Site Scripting: http://www.cgisecurity.com/articles/xss-faq.shtml
--
Sincerely,
S. Justin Gengo, MCP
Web Developer / Programmer www.aboutfortunate.com
"Out of chaos comes order."
Nietzsche
"serge calderara" <se************ @discussions.mi crosoft.com> wrote in
message news:46******** *************** ***********@mic rosoft.com... Thnaks for your reply
Have you heard about those spaming method of hacker which make you feel
that
your are on your bank home page but in fact its there own in order to
collects data or destroy your system....
Does this ASP cross check validation on client and server side can prevent
from such thing happen ?
"S. Justin Gengo" wrote:
Serge,
All of the .NET validators attempt to validate each control client-side
in
order to save a trip to the server. This is done so that the user
experience
is faster whenever possible. However, no client-side only validation is
secure because the server should never trust what the client is sending
it.
So the data is again validated server side. Validation server side may be
checked by wrapping any code that will be using the input in question
with
something along the lines of:
If Page.IsValid Then
'---input is valid run code here
End If
If the code isn't valid the validator's automatically display error
messages. This two tier system allows client machines capable of running
the
validation javascripts better the user experience, but still makes
certain
that input is valid and that browsers without the client-side validation
capabilities still have the same (albeit slower) validation experience.
--
Sincerely,
S. Justin Gengo, MCP
Web Developer / Programmer
www.aboutfortunate.com
"Out of chaos comes order."
Nietzsche
"serge calderara" <se************ @discussions.mi crosoft.com> wrote in
message news:F9******** *************** ***********@mic rosoft.com... > Dear all,
>
> I have read that ASP.NET does double user input validation of control
> when
> they are place on the page. Once on teh client side and again from
> server
> side right ?
>
> Could explain how this process is exaclty working ?
>
> regards
> thnaks for your help
> Serge
no. the serverside validation performs two function, support browsers other
than IE (or ir has scripting turned off), and allow validation where
serverside code must be run to perform the validation.
-- bruce (sqlwork.com)
"serge calderara" <se************ @discussions.mi crosoft.com> wrote in
message news:46******** *************** ***********@mic rosoft.com... Thnaks for your reply
Have you heard about those spaming method of hacker which make you feel
that
your are on your bank home page but in fact its there own in order to
collects data or destroy your system....
Does this ASP cross check validation on client and server side can prevent
from such thing happen ?
"S. Justin Gengo" wrote:
Serge,
All of the .NET validators attempt to validate each control client-side
in
order to save a trip to the server. This is done so that the user
experience
is faster whenever possible. However, no client-side only validation is
secure because the server should never trust what the client is sending
it.
So the data is again validated server side. Validation server side may be
checked by wrapping any code that will be using the input in question
with
something along the lines of:
If Page.IsValid Then
'---input is valid run code here
End If
If the code isn't valid the validator's automatically display error
messages. This two tier system allows client machines capable of running
the
validation javascripts better the user experience, but still makes
certain
that input is valid and that browsers without the client-side validation
capabilities still have the same (albeit slower) validation experience.
--
Sincerely,
S. Justin Gengo, MCP
Web Developer / Programmer
www.aboutfortunate.com
"Out of chaos comes order."
Nietzsche
"serge calderara" <se************ @discussions.mi crosoft.com> wrote in
message news:F9******** *************** ***********@mic rosoft.com... > Dear all,
>
> I have read that ASP.NET does double user input validation of control
> when
> they are place on the page. Once on teh client side and again from
> server
> side right ?
>
> Could explain how this process is exaclty working ?
>
> regards
> thnaks for your help
> Serge
Thnaks for your link
regard
serge
"S. Justin Gengo" wrote: Serge,
Here's a good article on Cross Site Scripting:
http://www.cgisecurity.com/articles/xss-faq.shtml
--
Sincerely,
S. Justin Gengo, MCP
Web Developer / Programmer
www.aboutfortunate.com
"Out of chaos comes order."
Nietzsche
"serge calderara" <se************ @discussions.mi crosoft.com> wrote in
message news:46******** *************** ***********@mic rosoft.com... Thnaks for your reply
Have you heard about those spaming method of hacker which make you feel
that
your are on your bank home page but in fact its there own in order to
collects data or destroy your system....
Does this ASP cross check validation on client and server side can prevent
from such thing happen ?
"S. Justin Gengo" wrote:
Serge,
All of the .NET validators attempt to validate each control client-side
in
order to save a trip to the server. This is done so that the user
experience
is faster whenever possible. However, no client-side only validation is
secure because the server should never trust what the client is sending
it.
So the data is again validated server side. Validation server side may be
checked by wrapping any code that will be using the input in question
with
something along the lines of:
If Page.IsValid Then
'---input is valid run code here
End If
If the code isn't valid the validator's automatically display error
messages. This two tier system allows client machines capable of running
the
validation javascripts better the user experience, but still makes
certain
that input is valid and that browsers without the client-side validation
capabilities still have the same (albeit slower) validation experience.
--
Sincerely,
S. Justin Gengo, MCP
Web Developer / Programmer
www.aboutfortunate.com
"Out of chaos comes order."
Nietzsche
"serge calderara" <se************ @discussions.mi crosoft.com> wrote in
message news:F9******** *************** ***********@mic rosoft.com...
> Dear all,
>
> I have read that ASP.NET does double user input validation of control
> when
> they are place on the page. Once on teh client side and again from
> server
> side right ?
>
> Could explain how this process is exaclty working ?
>
> regards
> thnaks for your help
> Serge
This thread has been closed and replies have been disabled. Please start a new discussion. Similar topics | |
by: Nikol |
last post by:
We all know that some users try to post strange data to our databases,
so like many others I make validation with ereg() and regular
expressions. But some users find it very annoying, if they have to
retype some of the correctly posted fields when I send them back after
an error message from my php validation.
So I found out that making client side javascript validation as well can
improve usability of my pages. I continue making server...
|
by: Scott Meyers |
last post by:
I have a web site that, due to maintenance by several people, some of whom are
fairly clueless about HTML and CSS, etc. (notably me), has gotten to the point
where I'm pretty sure it's suffering from bit rot. Though the pages seem to
display okay under IE and FF, I really think it's time for an under-the-hood
cleaning. I recently received a copy of Molly Holzschlag's "Spring Into HTML
and CSS," and in the first chapter, she makes a big...
|
by: Gérard Talbot |
last post by:
Cross-posted to: comp.infosystems.www.authoring.html and alt.html
Followup-to: comp.infosystems.www.authoring.html
1- One day, I stumbled across a website that offers to validate
webpages. What was really special about that site is that the validation
service was available in Russian, German, Spanish and English. Now, I
can't find this site anymore. I did search google. Do you know such
site? What's its url?
2- Generally speaking, the...
|
by: Rick |
last post by:
I have an interesting problem when I run the following
code in Netscape (7.02) vs. IE. This page works great in
IE and all my controls bring up the validation summary
dialog box if the required field is not filled out.
However in Netscape NONE of the required field
validations occurs at all in Netscape. The form is
posting correctly because I can walk through the post
back process. Any ideas why this is happening or how to
fix it?
|
by: AIM48 |
last post by:
Hi.
We have a framework that we work with for our project. So far we
have had very good success – basically the frame work wraps many day to day
tasks so that they are all included in the project. The framework is built on
a modified Page Controller pattern in which a aspx page controls the loading
of clients (user controls) into a placeholder (Sort of similar to .net 2.0
Master Pages except that the page loads the client not the client...
| | |
by: Bob Alston |
last post by:
I have a routine to copy data to new versions of my app via insert into
sql statements. Unfortunately, due to evolution of my app, sometimes
the new version has more restrictive editing than an older version that
I am updating. Thus I get this message. It tells me only how many
records have errors, not which errors or which records.
Anyone have a nice solution to identifying the specific records involved?
Maybe even the specific...
|
by: Stone Chen |
last post by:
Hello,
I have form that uses javascript createElement to add additional input
fields to it. However, my validating script will not process new input
fields because it can only find the named input boxes already on the page.
Anyone has any thoughts on how to solve this, your advice is much
appreciated.
Thanks
|
by: Joe Befumo |
last post by:
This is my first attempt at multi-thread programming, and I'm encountering a
program-logic problem that I can't quite put my finger on.
The program is pretty simple. I'm trying to validate a large list of email
addresses. Since the actual validation can take some time, I'm spawning new
threads, up to a predetermined maximum value, to process each new address.
|
by: Water Cooler v2 |
last post by:
Sorry for asking this beginner question.
I've written DTDs so far and read about XML Schemas. I understand that
they are a replacement of the DTD fundamentally, and therefore allow
for the validation of an XML document.
My question really is:
Why do we need XML Schemas other than for validation of an XML
document? I am more interested in knowing if already available
|
by: marktang |
last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look !
Part I. Meaning of...
|
by: Hystou |
last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it.
First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
| | |
by: jinu1996 |
last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth.
The Art of Business Website Design
Your website is...
|
by: tracyyun |
last post by:
Dear forum friends,
With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
|
by: agi2029 |
last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own....
Now, this would greatly impact the work of software developers. The idea...
|
by: isladogs |
last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM).
In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules.
He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms.
Adolph will...
|
by: conductexam |
last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one.
At the time of converting from word file to html my equations which are in the word document file was convert into image.
Globals.ThisAddIn.Application.ActiveDocument.Select();...
|
by: 6302768590 |
last post by:
Hai team
i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
| | |
by: bsmnconsultancy |
last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...
| |
