Sanitizing for MSAccess & ASP classic

 

' 1)
' Sanitize QueryString
' First try to avoid textual QueryString. However if it's to be text - use sanitizing methodes same as for textual forms (see below).
' for Numeric QueryString validate as follow:

<%
'CODE TO VALIDATE QueryString (PART1) STARTS HERE
RequestQueryString = Request.QueryString
If IsNumeric(RequestQueryString) Then
'CODE TO VALIDATE QueryString (PART1) ENDS HERE
%>


' !!!!!!some code!!!!!!!
' !!!!!!some code!!!!!!!
' !!!!!!some code!!!!!!!
' !!!!!!some code!!!!!!!


<%
'CODE TO VALIDATE QueryString (PART2) STARTS HERE
else
Response.Write("<br><br><center><h2><font color=red>Error! You made a mistake.</font></h2></center><br><br>")
end if
'CODE TO VALIDATE QueryString (PART2) ENDS HERE
%>

'NOTE: IsNumeric also protects against empty QueryString.
'NOTE 2: However you still need to code the proper response for the case when QueryString value do not match any records in database
<%
Response.Write("<br><br><center><h2><font color=red><a href=index.asp>Error! You made a mistake.</a></font></h2></center><br><br>")
%>






------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
' 2)
' Sanitize Numeric Form
' and do not forget to trim it.


<%
'CODE TO VALIDATE Numeric Form (PART1) STARTS HERE
FromFormSomething = Trim(request.form("Something"))
If IsNumeric(FromFormSomething) Then
'CODE TO VALIDATE Numeric Form (PART1) ENDS HERE
%>


' !!!!!!some code!!!!!!!
' !!!!!!some code!!!!!!!
' !!!!!!some code!!!!!!!
' !!!!!!some code!!!!!!!


<%
'CODE TO VALIDATE Numeric Form (PART2) STARTS HERE
else
Response.Write("<br><br><center><h2><font color=red>Error! You made a mistake.</font></h2></center><br><br>")
end if
'CODE TO VALIDATE Numeric Form (PART2) ENDS HERE
%>

'NOTE: IsNumeric also protects against empty form.
'NOTE 2: However you still need to code the proper response for the case when Form value do not match any records in database
<%
Response.Write("<br><br><center><h2><font color=red><a href=index.asp>Error! You made a mistake.</a></font></h2></center><br><br>")
%>




' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
' 3)
' Sanitize textual form 
' and do not forget to trim it.
' First escape from apostrophe and quotes and also carriage returns and brakes
' Second apply regular expression to filter and block dangerous items
' NOTE: edit regexp properly to exclude too strict patterns.


<%
'CODE TO CALL SANITIZING ESCAPE FUNCTIONS STARTS HERE

Function crlfToBr(strValue)
If Not IsNull(strValue) Then
strValue = Replace(strValue, Chr(13) & Chr(10), "<br>")
End If
crlfToBr = strValue
End Function

Function quotreplace(strValue)
If Not IsNull(strValue) Then
strValue = Replace(strValue, """, """)
End If
quotreplace = strValue
End Function

Function apostrophereplace(strValue)
If Not IsNull(strValue) Then
strValue = Replace(strValue, "'", "''")
End If
apostrophereplace = strValue
End Function

'CODE TO CALL SANITIZING ESCAPE FUNCTIONS ENDS HERE
%>



<%
'CODE TO ESCAPE FROM APOSTROPHE ETC AND TO CALL VARIABLE STARTS HERE

FromFormSomething=apostrophereplace(quotreplace(cr  lfToBr(Trim(request.form("Something")))))

'CODE TO ESCAPE FROM APOSTROPHE ETC AND TO CALL VARIABLE ENDS HERE
%>


'NOTE: you still need to do not forget to check if your form is empty or not.
<% 
' CODE TO CHECK IF FORM IS NOT EMPTY (PART 1) STARTS HERE
if FromFormSomething="" then
Response.Write("<br><br><center><h2><font color=red><a href=index.asp>Error! You made a mistake.</a></font></h2></center><br><br>")
else
' CODE TO CHECK IF FORM IS NOT EMPTY (PART 1) ENDS HERE
%>

<%
'CODE TO CALL SANITIZING FUNCTION ze STARTS HERE - most strict function but still requires to be used in conjunction with apostrophe and quotes escaping functions. 
' COMBINATION OF SYMBOLS <something>          <.*> 
' CURLY BRACES COMBINATION {something}        \{.*\} 
' DOUBLE DASH --                              -{2,}?
' WORDS AND PHRASES                           delete|drop table|NULL
' ASTERISK                                    \*
' BACKSLASH                                   \\
' OPENING SQUARE BRACKET                      \[
' http://netzreport.googlepages.com/online_converter_for_dec_octal.html could be usefull in some specific cases to convert decimal ASCII into octal number: chr34 = 42 to create even more strict regexp.
' http://www.regular-expressions.info/reference.html

Dim ze
  Set ze = new RegExp
	ze.IgnoreCase = true
	ze.pattern = "<.*>|\{.*\}|-{2,}?|delete|drop table|NULL\\*|\\|\["
	ze.global = TRUE
'CODE TO CALL SANITIZING FUNCTION ze ENDS HERE

'CODE TO VALIDATE TEXT FORMS (PART 1) STARTS HERE: 
'if ze.Test(FromFormSomething) = False and ze.Test(FromAnotherFormSomething) = False and ze.Test(FromOneMoreFormSomething) = False Then
'CODE TO VALIDATE TEXT FORMS (PART 1) ENDS HERE: 


' !!!!!!some code!!!!!!!
' !!!!!!some code!!!!!!!
' !!!!!!some code!!!!!!!
' !!!!!!some code!!!!!!!


'CODE TO VALIDATE TEXT FORMS (PART 2) STARTS HERE: 
<%
else
Response.Write("<br><br><center><h2><font color=red><a href=index.asp>Error! You made a mistake.</a></font></h2></center><br><br>")
end if
%>
'CODE TO VALIDATE TEXT FORMS (PART 2) ENDS HERE: 


<% 
' CODE TO CHECK IF FORM IS NOT EMPTY (PART 2) STARTS HERE
end if
' CODE TO CHECK IF FORM IS NOT EMPTY (PART 2) ENDS HERE
%>

'NOTE 2: You still need to code the proper response for the case when Form value do not match any records in database
<%
Response.Write("<br><br><center><h2><font color=red><a href=index.asp>Error! You made a mistake.</a></font></h2></center><br><br>")
%>



' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
' 4) Sanitize textual QueryString
' use the same code as above for textual forms, but replace request.form("Something") for Request.QueryString



' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
' 5) Sanitize radio-buttons and tick-boxes
' I normally sanitize them as above depending on what type of value it returns - numeric or textual. 
' If assortment of values is very limited and strict like "yes" or "no" you can edit regexp to make it specifically strict to only approve "yes" and "no"



' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
' 6) True/False
' I never use true/false fields in database (prefer 1 and 0 instead) so I did not think about that matter at all.
' Any thoughts are welcome