CAn anyone see a problem in this?

Jerkycold · Jun 18, 2003

<html>
<head>
<title> Process Login Include Test Page </title>
</head>

<body>



<%
username = Request.Form("Username&quot

password = Request.Form("Password&quot

Response.Write(Username & " " & Password & "<br>&quot

If username <> "" Then
SQL = "SELECT * FROM employees WHERE username='" & username & "' AND password ='" & password & "'"
End If

set cmdDC = Server.CreateObject("ADODB.Command&quot

cmdDC.ActiveConnection = Conn

cmdDC.CommandText = SQL
Set RecordSet = Server.CreateObject("ADODB.Recordset&quot

'-- Cursor Type, Lock Type
'-- ForwardOnly 0 - ReadOnly 1
'-- KeySet 1 - Pessimistic 2
'-- Dynamic 2 - Optimistic 3
'-- Static 3 - BatchOptimistic 4

RecordSet.Open cmdDC, , 0, 2

If Not RecordSet.EOF Then
Response.Write("User has been found!&quot

empid = RecordSet.Fields("EmployeeID&quot

empfname = RecordSet.Fields("FirstName&quot

emplname = RecordSet.Fields("LastName&quot

' Dim struserLevel
' struserLevel = RecordSet.Fields("userLevel&quot

' Session("userLevel&quot

= struserLevel
Session("empid&quot

= empid
Session("empfname&quot

= empfname
Session("emplname&quot

= emplname
Response.Redirect("

http://pacific/peregrine/loui.asp")

Else
'The user was not validated...
'Take them to a page which tells them they were not validated...
'Response.Redirect "register.asp"
Response.Write("User has NOT been found!&quot

Response.Redirect("

http://pacific/peregrine/default.asp?flag=1")

End If

Conn.Close
cmdDC.ActiveConnection = Nothing

%>
</body>

</html>

my logon works fine if you put in the correct username and password, and it works great if you put in the wrong username and password, but if you dont put anything at all in the username and try to login it breaks and says there is a error type:

Microsoft OLE DB Provider for ODBC Drivers (0x80040E0C)
Command text was not set for the command object.
/processlogin.asp, line 31

TootingBoy · Jun 18, 2003

It seems to be a problem in the logic of your procedure. If no username is passed through then you do not generate any sql. However, you are still continuing with the procedure and executing an empty sql string - hence the error.

It might also be worth pointing out that, from a security point of view, your code is vulnerable to a variety of hack attacks, including sql injection. You should always sanitise any parameters passed by users before including them in an sql statement.

The path to freedom is seldom trodden by the multitude.

Mr3Putt · Jun 18, 2003

To stop processing when UserName is empty, do something like:

Code:

If  username = &quot;&quot; then
  %>
  <h1>Blank User Name</h1>
  <%
  Response.End  ' stops all processing...
End If

' there must be a username if we got this far...
SQL = &quot;SELECT * FROM employees WHERE username='&quot; & username & &quot;' AND password ='&quot; & password & &quot;'&quot;
set cmdDC = Server.CreateObject(&quot;ADODB.Command&quot;)
cmdDC.ActiveConnection = Conn

Jerkycold · Jun 18, 2003

Thanks for your help Mr3putt it worked great. Tooting boy how would you suggest I might sanitise my parameters passed by users before including them in sql statement?

Mr3Putt · Jun 18, 2003

I think, generally, you can thwart most SQL insertion by checking values for Apostrophes (').

SQL Insertion is where, I might type the following into the UserName and Password fields:

A' OR ('A'='A
A') OR 'A'='A

...your SQL stmt becomes:

Code:

WHERE username='A' OR ('A'='A' AND password ='A') OR 'A'='A'

...and your result is ALWAYS TRUE...

So, if you first Replace(username,"'","&quot

... it would create an invalid SQL stmt.

[green](those with better hacking skills than I, don't laugh. Instead, provide a more succinct sample of SQL insertion code);-)[/green]

TootingBoy · Jun 18, 2003

Mr3Putt is right that the main issue is dealing with apostrophes. Although the method of dealing with this is not to replace apostrophes with an empty string but to double them up like so:

Code:

Replace(username,&quot;'&quot;,&quot;''&quot;)

However, this is not merely a syntactical issue. By entering an apostrophe and semi-colon a hacker can append their own sql to yours, e.g. they could attempt to drop your master db or use sql server to run system commands (or basically do anything they like.)

Other checks are

- making sure that the parameter does not exceed a specified length
- making sure that the parameter is of the correct data type.

IMHO the best source of information on this topic is probably 'Writing Secure Code' from the Microsoft Press.

Safe Coding!

The path to freedom is seldom trodden by the multitude.

Jerkycold · Jun 18, 2003

I hate to sound stupid but, what do I replace do I replace this:

SQL = "SELECT * FROM employees WHERE username='" & username & "' AND password ='" & password & "'"

Can you show me what I should replace so I can understand?

Thanks

DreXor · Jun 18, 2003

Yours :
SQL = "SELECT * FROM employees WHERE username='" & username & "' AND password ='" & password & "'"

Corrected :
SQL = "SELECT * FROM employees WHERE username='" & Replace(Username,"'","''&quot

& "' AND password ='" & Replace(Password,"'","''&quot

& "'"

Hope that helps

Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

CAn anyone see a problem in this?

Jerkycold

IS-IT--Management

TootingBoy

Programmer

Mr3Putt

Programmer

Jerkycold

IS-IT--Management

Mr3Putt

Programmer

TootingBoy

Programmer

Jerkycold

IS-IT--Management

DreXor

Programmer

Similar threads

Part and Inventory Search

Sponsor