asked on

META - redirect security

Hi.

I have a form where users can write text online and also use html in it. I know that you can redirect to another page using some META. How can I prevent this?

Shall I check the string if it include som words?

Let play a little bit here..

Let say that I shall store strInput in a table field and I want to check it before. How can that code look like?

Rgrds

ASKER CERTIFIED SOLUTION

John844

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

John844

that will handle your meta-refresh tags as well as script tags that they might be adding like <% and %>. This will cause a problem with any client side script if you wish to allow them to enter it into the database.

if you need to use the client side script then you will need to replace multiple items...

I would replace <% with >%.
I would replace meta with something like me ta.

there are probably many more, but that is what pops to mind right now.

sporfex

ASKER

But can they use ordinary links etc. They should.

like



<a href....

etc.

Want them to use such shings.

John844

that would still work if you use the second method of replacing <% and meta...

sporfex

ASKER

Spme code suggestion how to use replace?

hongjun

Replace function Code example.

<%
Dim str

str = "<%haha"
Response.Write str & " "
str = replace(str, "<%", "//")
Response.Write str
%>

hongjun

John844

'get the current value
strNewValue = request("yourFormField")
'replace <%
strNewValue = replace(strNewValue,"<%",">%")
'replace meta
strNewValue = replace(strNewValue,"meta","me ta")

'save the new value to the database
rs("fieldName") = strNewValue

John844

here is the basic workings of replace()
replace(strInput,strFind,strReplace)

replace looks in strInput for all occurances of strFind. It replaces each occurance with the contents of strReplace.

strInput = "thisandthat"

'replace every t with x in the string "thisandthat"
strInput = replace(strInput,"t","x")

'strInput now holds "xhisandxhax"