Form security using SESSION.SESSIONID

I’ve been having problems recently with attempted spamming exploits on my form to email scripts (i.e. users downloading forms, messing with them and then submitting them remotely to my form handling scripts) and thought I’d see if comparing the sessionID of the sending pages and form handling pages could help to weed out these fake submissions.
Continue reading

Tips for Classic ASP developers on Vista

Installed Vista Ultimate the other day, after much customising, I finally got round to installing IIS, everything seemed to work fine, until I migrated my Classic ASP applications. Stumbled across a whole bunch of issues, which I finally resolved thanks to a bit of research on Google, so I thought I’d share some of these tips not only for others but also for myself in case I have to do it again in the future.

Continue reading

Reducing the Risk of SQL Injection Attack

Databases can be compromised if they are open to SQL Injection Attack. Stripping invalid characters from form inputs will reduce this risk.

If you have a form on your site that interacts with a database (e.g. a username/password login form), you should secure the form by adding an additional stage between submission and the database look-up. One way to do this is to check for valid content. Continue reading