|
James T. Johnson wrote:
on SQL Server it can spell security disaster
Hmm, I don't see why it is a security hole. If one forgets to double the quotas, this is his problem, not of SQL Server 
Philip Patrick
Web-site: www.stpworks.com
"Two beer or not two beer?" Shakesbeer
Need Web-based database administrator? You already have it!
|
|
|
|
|
Oh No, I'm not blaming it on SQL Server; it would the same as me putting an admin only link on the front page of a website and trusting no one but me to click on it
James
Simplicity Rules!
|
|
|
|
|
Lol, hehe, wanna try?
BTW, I made a simple test. I put a link somewhere in one of my sites, saying "Don't click here, this link is for web master". Then made a counter of clicks on it. And what you think? 300+ people out of about 500 visitors of this page, clicked on it
Lol, that was funny, when I told them at the end what it was
Philip Patrick
Web-site: www.stpworks.com
"Two beer or not two beer?" Shakesbeer
Need Web-based database administrator? You already have it!
|
|
|
|
|
2 options.
1- using the " character .. chr(34).
strSQL = " INSERT INTO table( field)"
strSQL = "VALUES(" & chr(34) & "Go'day" & chr(34) & ")"
2- Replace the ' to '', SQL only save one '
strSQL = " INSERT INTO table( field)"
strSQL = "VALUES('" & Replace(strVar,"'","''") & "')"
FF
|
|
|
|
|
What are the alternatives to session logins...?
I need something a little more secure than session cookies but not quite SSL inclusion.
If someone is desperate enough to sniff my pass/ID what will be will be, but session cookies aren't quite good enough.
Any suggestions...?
Links to topics would be great too.
Thanx!
"An expert is someone who has made all the mistakes in his or her field" - Niels Bohr
|
|
|
|
|
|
Something very similar.
Thanx i'll check the link out!
"An expert is someone who has made all the mistakes in his or her field" - Niels Bohr
|
|
|
|
|
well it seems i got something happening by installing the iis thing on the same machine im working on ... all seems a bit flaky to me right now but i'll persevere for now
anyways now im getting this in my browser all the time:
error '8002801d'
Library not registered.
/iisHelp/common/500-100.asp, line 10
god only knows what isnt registered
does anybody know what drugs these people were on when they wrote this error message and how i might fix it?
situations to avoid #37:
"good morning ... how many sugars do you take in your coffee ... and what was your name again?"
coming soon: situations to avoid #38: "...and the dog was there too?"
|
|
|
|
|
Why not to go to that file, find the line 10 and check which library it tries to load?
Can't do it by myself, I deleted all IIS files, lmao
Philip Patrick
Web-site: www.stpworks.com
"Two beer or not two beer?" Shakesbeer
Need Web-based database administrator? You already have it!
|
|
|
|
|
Hmm, well, I found it, I forgot that WINNT directory is also kinda a web site root. You can find the file in ..WINNT\iisHelp\Common\..
Looks like Response causes this error. Dunno though what happend to your IIS, never had such problem. Maybe you want to try to re-install it?
Philip Patrick
Web-site: www.stpworks.com
"Two beer or not two beer?" Shakesbeer
Need Web-based database administrator? You already have it!
|
|
|
|
|
ummm am i running iis5 if i installed win2k pro instead of server? someone said to me todays that win2k pro has some half assed personal web manager thing which isnt actually iis ... is that true and would that be causing the problems im having?
situations to avoid #37:
"good morning ... how many sugars do you take in your coffee ... and what was your name again?"
coming soon: situations to avoid #38: "...and the dog was there too?"
|
|
|
|
|
Win2K pro comes with IIS 5, but you can also install the other one, its a choice in the windows components with IIS.
James
Simplicity Rules!
|
|
|
|
|
|
This may be a stupid and simple question, but I know next to nothing about ASP. So please take it easy on me.
I’ve just recently been place in charge of fixing a miss-behaving web application. I seems that the administration pages do not function properly anymore. The problem with the pages pops-up when the server-side VBScript code attempts to write to the registry.
The problem arises in the following code:
Dim WshShell<br />
Set WshShell = CreateObject ( "WScript.Shell" )<br />
WshShell.RegWrite "HKLM\Software\SomeApplication\AdminUserID", "SomeUserID"
The error page that the server returns reads:
Error Type:
WshShell.RegRead (0x80070005) <-- Access denied error, I believe.
Invalid root in registry key "HKLM\Software\SomeApplication\AdminUserID".
/apps/rtj/change_admin.asp, line 5
Why does this not work?  ... AND why is it showing that I'm calling RegRead, when in fact I'm calling RegWrite?!? 
thanks for your help,
-Ben
|
|
|
|
|
Is your application/web server set up to allow anonymous users to connect? If it is, then it's my guess that anonymous users don't have proper machine priviliges to write to the registry. Your code will be executing under the IUSR_YOUR_MACHINE_NAME account which doesn't, and shouldn't, have access to write to the registry.
|
|
|
|
|
Yes and no. No, because the admin pages are not accessible to anonymous users, and yes because the rest of the site is (just a simple 'is admin' check at the top of the admin pages thrown in just to make sure).
Gerald Schwab wrote:
Your code will be executing under the IUSR_YOUR_MACHINE_NAME account which doesn't, and shouldn't, have access to write to the registry.
So, if I give the administrator's account proper privelages on the box it should work fine?
Thanks for the help.
cheers,
-Ben
|
|
|
|
|
So, if I give the administrator's account proper privelages on the box it should work fine?
Well I'm not totally sure that this is the answer to your problem, but when I tried it on my machine I got the same error as you are getting. When I disallowed anonymous in IIS, it worked fine. So yes, basically you need to give the account that the ASP page is running under, permissions to access the registry. Or better yet, I would recommend that you disallow anonymous access and force ASP page to run under the individual users credentials. If your users are using IE, then this will be seemless by choosing "Integrated Windows Authentication" in IIS, otherwise your users will have to log in each time they access the ASP page using "Basic Authentication". Then give just add those users that you want to give rights, to a windows nt group that has access to the registry.
|
|
|
|
|
Beauty! I’ll give that a go. Thanks Gerald!
cheers,
-Ben
|
|
|
|
|
let me rephrase the original question
i set up a website on my network server running iis
i put an index.html file in the folder
i put a test.asp file in the same folder
a form thing in the html file references the asp file as its action
when i click the submit button i get "cant access requested file error 500"
grrrrrrrrr
do i have to chant some magic invcantations or put the damn asp file in some special folder or point a gun at the iis box or jump off a tall building or just give the f**k up????
please please please help
or you might see a grown woman cry
there too?"
|
|
|
|
|
I use IIS only for ASP.NET,So I'm not sure for your problem...Check properties of your project in iis in Directory tab,and also the properies of your html and asp files.Maybe you don't have some security access for that file or your project.
I hope you won't cry.  
Mazy
"The path you tread is narrow and the drop is shear and very high,
The ravens all are watching from a vantage point near by,
Apprehension creeping like a choo-train uo your spine,
Will the tightrope reach the end;will the final cuplet rhyme?"Cymbaline-Pink Floyd
|
|
|
|
|
Well, IIS is not only for ASP.NET but for old ASP also.
The problem could be that your test.asp file generates some error, and if you are trying it on your hosting provider, it hides the error and tells you "error 500". So the question is: is the test.asp file just an empty file, or contains any code in it?
Also if you are trying on your own computer, remember that the folder/web should have right Execute permissions of this folder. To check this, open your computer management console (assuming you are in Win2k, dunno how to work with PWS), and open IIS, then find your directory under Web Server. Right click and on the first tab you will see "Execute permissions". Make sure it is not set to "None". Usually it is "Scripts only"
Philip Patrick
Web-site: www.stpworks.com
"Two beer or not two beer?" Shakesbeer
Need Web-based database administrator? You already have it!
|
|
|
|
|
As Phillip said, it is most likely an error in the code of the ASP page. In IE, make sure you have turned off friendly error messages, and in IIS, for the website you are using, choose properties, and find the error documents. Make sure you select error 500 and click the Set To Default button.
--
David Wengier
Sonork ID: 100.14177 - Ch00k
|
|
|
|
|
this is what i get in ie6 after turning off friendly error messages:
Server Application Error
The server has encountered an error while loading an application during the processing of your request. Please refer to the event log for more detail information. Please contact the server administrator for assistance.
the event log warning message on the web server box says:
The server failed to load application '/LM/W3SVC/1/ROOT/8028test'. The error was 'No such interface supported'.
i also read that if your iis / pwc isnt installed right the online help doesnt show up ... mine doesnt ... wtf must i do to get the damn iis / pwc thing running??
pulease help
situations to avoid #37:
"good morning ... how many sugars do you take in your coffee ... and what was your name again?"
coming soon: situations to avoid #38: "...and the dog was there too?"
|
|
|
|
|
just for completeness here are the two files in question ... i cant see where the error on the asp page is but i dont much about this stuff yet so maybe im missing something ???
index.html:
-----------
<HTML>
<HEAD>
<TITLE>login</TITLE>
</HEAD>
<body bgcolor="#FFFF80">
<form name="form1" action="test.asp" method="post">
Email: <input name="email" maxlength="100" size="50"><br>
Password: <input name="pw" maxlength="12" size="20"><P>
<input type="submit" value="Log In"> <input type="reset" value="Clear">
</form>
</BODY>
</HTML>
test.asp:
---------
<% @Language = "VBScript" %>
<%
Option Explicit
Response.Buffer = True
Response.Expires = -1000
dim stremail
dim strpw
strEmail=request("email")
strPw=request("pw")
Response.Write("hello " & stremail & ", how are you?")
Response.Write("<BR>your password is " & strpw)
%>
|
|
|
|
|
Try removing line by line a code from your test.asp. This way you will find out which code generates the error.
I believe it is Response.Buffer = True. I remember I had some problems with it too, but don't remember how I solved them 
Philip Patrick
Web-site: www.stpworks.com
"Two beer or not two beer?" Shakesbeer
Need Web-based database administrator? You already have it!
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
