guestbook hacked

[ksbigfoot]

I created a guestbook using Active Server Pages. I am passing around a session variable, that is created when you go into the main page. This session variable is required before anything can be inserted into my guestbook.
Some hacker has found a way around this. Not sure how he is doing this, but he is inserting 5 records a day into my guestbook. I am tracking his IP address though ASP code, but every IP address is different, but I know it is coming from the same person as the wording is identical.
Can someone point me in the right direction or if this is the wrong forum, point me to the right forum?

Thanks

 

[sleipnir214]

What would happen if someone were to clear cookies for your domain then revisit the site?



Want the best answers? Ask the best questions! TANSTAAFL!

 

[ksbigfoot]

My pages check everytime that an INSERT is to occur that they have session variables (which are set in the main page). If no session variables are available, the INSERT doesn't occur.