I’ve been having problems recently with attempted spamming exploits on my form to email scripts (i.e. users downloading forms, messing with them and then submitting them remotely to my form handling scripts) and thought I’d see if comparing the sessionID of the sending pages and form handling pages could help to weed out these fake submissions.
Installed Vista Ultimate the other day, after much customising, I finally got round to installing IIS, everything seemed to work fine, until I migrated my Classic ASP applications. Stumbled across a whole bunch of issues, which I finally resolved thanks to a bit of research on Google, so I thought I’d share some of these tips not only for others but also for myself in case I have to do it again in the future.
Databases can be compromised if they are open to SQL Injection Attack. Stripping invalid characters from form inputs will reduce this risk.
If you have a form on your site that interacts with a database (e.g. a username/password login form), you should secure the form by adding an additional stage between submission and the database look-up. One way to do this is to check for valid content. Continue reading
Using the MD5 and SHA1 hash functions
If you’re using a login script on your site you probably store usernames and passwords in a database for authenticating the login.
For security reasons, you should never store these as plain text but should encrypt them with a one-way hash function such as md5 or sha1.