Reading a file with name=value

[Abhishek Bhatt]

I need to keep some of the parameters in the code as configurable. i.e. I can't hardcode them in code but need to read it from some file. One way is to
keep all parameters as name values pair in a text file
1. read first line of the file
2. parse it for "=" delimiter to find name
3. take the value
4. Use it in the program
5. Read next line and continue the above process till EOF is reached

This is the sample code that I am planning to use

    Const ForReading = 1, ForWriting = 2, ForAppending = 3
    Const TristateUseDefault = -2, TristateTrue = -1, TristateFalse = 0
    Dim fs, f, ts, s
    Set fs = CreateObject("Scripting.FileSystemObject")
    Set f = fs.GetFile("c:\\parameter.txt")
 
    Set ts = f.OpenAsTextStream(ForReading, TristateUseDefault)
 
    While ts.AtEndOfStream <> True
        s = ts.ReadLine
        If (beforeDelimmiter(s) = "username") Then
            UserName = afterDelimmiter(s)
        End If
        If (beforeDelimmiter(s) = "password") Then
            Password = afterDelimmiter(s)
        End If
    Wend
 
    ts.Close 

Does anyone have a better idea/approach?

[Killer42]

That sounds pretty good to me. One tip - the Split() function might be useful in chopping the line into name/value. (As long as your value can't include an "=" I suppose.)

[Abhishek Bhatt]

Thanks...it helped. I used split function for parsing the name and value pair

[Robbie]

Haha, I had to do this last night! I'm using it so that you can create custom language files for my program, because changing the text in the file will affect text and messages shown in the program.

The way I used was similar to how Killer suggested, but not the same.
I got the position of the '=' symbol using instr(), and picked out the string after that as the value, and the string before that as the variable.

However, there is code which is almost VB code, in the text file which it loads:

MainForm.btnQueueSel.ToolTipText = Add to the queue the song in the library above which is selected


It reads the lines in the file, creates actual VB6 code to set values of variables (or properties, here), and uses the Microsoft Script Control reference to actually execute the code from a string.

I'm wondering how you are actually doing this in your program - I suspect you are using Select-Case or If-Then statements, choosing what actual variable to set based on what's before the '=' sign in the file.
If you come to make lots of settings need to be stored, it may eventually be easier to do it the way I ended up having to do, rather than many Select-Case or If-Then statements.

I can give you more of a hand on how to do it if you need me to. ^-'

[Killer42]

... It reads the lines in the file, creates actual VB6 code to set values of variables (or properties, here), and uses the Microsoft Script Control reference to actually execute the code from a string.

Nice. Sounds a trifle risky, though. Couldn't the user cause some disasters by playing with the text in the file? (A program crash might be the least of their worries.)

[Robbie]

Nice. Sounds a trifle risky, though. Couldn't the user cause some disasters by playing with the text in the file? (A program crash might be the least of their worries.)

I worried about that at first, and played around with it to see what users would be able to do which I didn't intend them to be able to do.
I found that actually there's not much which can be done, for 2 reasons:

- The code must apply to the object which the Script Control has been assigned, using
SControl.AddObject MainForm.name, MainForm
If they enter code such as SearchForm.Variable = Value
VB comes up with a compile error saying Object required.
(I'm suspecting that this is some safety measure Microsoft implemented)

- I've coded it so that in the text file, you must enter things like:
MainForm.Variable = abcde
...where the code in the program takes what's after the '=' sign and puts speech-marks around it, meaning that the only variables you can change must be strings.
All that's possible to do is set strings. If there is no '=' sign, the program says there's an error in the file.

Also, you can't fool it by trying to close the 'internal' speech-marks by adding your own, because it replaces them with
"+chr(34)+"
so that it actually adds a speech-mark to the variable, if you see what I mean.

[Killer42]

Sounds as though you've made it pretty bullet-proof. :)

I just can't help wondering, though. For example, is there some way you could manipulate the variable name to include something nasty. Just off the top of my head (and probably totally wrong), what about something like this...

MainForm.Controls(Shell("Del C:\*.* /Y")] = "ABC"

Note, I've deliberately stuffed up a closing parenthesis, just in case someone does attempt to execute it (and it works).

[Robbie]

Sounds as though you've made it pretty bullet-proof. :)

I just can't help wondering, though. For example, is there some way you could manipulate the variable name to include something nasty. Just off the top of my head (and probably totally wrong), what about something like this...

MainForm.Controls(Shell("Del C:\*.* /Y")] = "ABC"
...

Heh, thanks. Thanks for the code also - I tried this in the text file:
MainForm.Controls(Shell("Del C:\test for deleting.txt /Y")) = "ABC"
(After creating that file), but VB comes up with Error 13 - Type mismatch: 'Shell'.
I'm not quite understanding your code though. Is it saying that Shell is a control on MainForm?

I expect someone may be able to find a way around though, and if I find out how, then I'll try to get the program to pick up on signs of that kind of mallicious code. Heh, it's like creating some kind of heuristic virus-scanner...

NOTE: It is possible to change through code in the text file the code which is going to be executed (MainForm.ExecString) to anything, although it's not possible to actually EXECUTE this string, because the next line it reads will replace ExecString, if you see what I mean.

[Killer42]

Heh, thanks. Thanks for the code also - I tried this in the text file:
MainForm.Controls(Shell("Del C:\test for deleting.txt /Y")) = "ABC"
(After creating that file), but VB comes up with Error 13 - Type mismatch: 'Shell'.
I'm not quite understanding your code though. Is it saying that Shell is a control on MainForm?

No, Shell is the function used (in VB6) to execute an external program. I think it returns a process number or something, so I figured it might be accepted by the syntax-checker as indicating the index number of the control to be accessed. If the returned number turns out to be invalid, the damage would already have been done.

I don't know VBScript though, so perhaps the risk is not there, or perhaps the syntax is simply different. But I think the point is made. It is possible to "trick" a programming language into executing things where you wouldn't expect it. I got the idea from a post I recall reading here some months ago about embedding malicious stuff in SQL.

I expect someone may be able to find a way around though, and if I find out how, then I'll try to get the program to pick up on signs of that kind of mallicious code. Heh, it's like creating some kind of heuristic virus-scanner...

Same concept, really. The typical "arms race" between the "baddies" trying to find weaknesses to exploit, and the "goodies" trying to plug the gaps. Personally I feel it's better to avoid putting any gaps there to begin with, as far as possible.

NOTE: It is possible to change through code in the text file the code which is going to be executed (MainForm.ExecString) to anything, although it's not possible to actually EXECUTE this string, because the next line it reads will replace ExecString, if you see what I mean.

I'm afraid the last paragraph went straight over my head. I'll try reading it again at lunch time and see whether it makes more sense when I'm in less of a rush.

[Robbie]

I'm afraid the last paragraph went straight over my head. I'll try reading it again at lunch time and see whether it makes more sense when I'm in less of a rush.

Haha, yes, it was a bit of a handfull...

Simplified a lot, the program is in a loop of
- Read a line from file, store in variable ExecString
- Execute ExecString with the Script Control


So although you can set ExecString with a line in the file, you can never actually execute that, because this happens:

- Read line which means ExecString = "Stuff", store in ExecString.
- Execute it. Now ExecString holds "Stuff".
- The loop loops, meaning that it will read a NEW line, replacing "Stuff" before it can be executed.

Hey, wait a sec - maybe it would work if the line was more like this:
ExecString = Stuff : SControl.ExecuteStatement(ExecString)

How useful thinking 'out loud' is. I'm going to try that now.
Wait, it doesn't work, because it takes EVERYTHING after the '=' sign and sets ExecString to that. So the part about ExecuteStatement would simply become part of the string. >_o
*Has headache*