Classic ASP Discussion - Security / hack protection

Print Page | Close Window

Security / hack protection

Printed From: Web Wiz Forums
Category: General Discussion
Forum Name: Classic ASP Discussion
Forum Description: Discussion on Active Server Pages (Classic ASP).
URL: https://forums.webwiz.net/forum_posts.asp?TID=1575
Printed Date: 28 March 2026 at 11:07pm
Software Version: Web Wiz Forums 12.08 - https://www.webwizforums.com

Topic: Security / hack protection

Posted By: pedalcars
Subject: Security / hack protection
Date Posted: 03 April 2003 at 8:58am

What more can I do?

Current protection against hacks:

Database:

My (access) database is outside the web directory (as recommended for this forum, for example);

Inputs:

All inputs that should be numeric only are checked and sanitised using a function (that I was given via this forum, ta) to ensure they are only numeric;
All alphabetic inputs are also checked (again, using a function I was given here!) to make sure they only contain valid characters (at the very most, a-z and underscore);
Where possible, inputs which will be more constrained if valid (eg, will only be in the range 0-4) are checked for this;

If any of the above three return false, the user is response.redirect'ed to an error page which states why they're there, ie, invalid ID entered; The same applies if any other seemingly-legitimate input produces a EOF/BOF error.

Edit: Correction - most invalid inputs result in a bounce to error page; some result in a bounce to a default page (eg, if the choice is between classes 1-4 and the user ammends the URL to try to select class 5, it will bounce to class 1 instead).

So, back to the question: What more can I do to secure my site, before considering I might have done "enough" and have to leave the rest to the host (eg, in terms of securing the server itself)?

-------------
http://www.pedalcars.info/ - www.pedalcars.info

The most fun on four wheels

Replies:

Posted By: faubo
Date Posted: 03 April 2003 at 9:18am

stress to your users that they should use really strange passwords.

-------------
http://www.conhecerparaconservar.org - I don't know how to make you click here