Solved

How to use string.contains with a character array?

Posted on 2007-04-04
7
675 Views
Last Modified: 2008-01-09
In an attempt to prevent querystring injection attacks, I need to check if a string contains a variety of characters.

Currently I have this...

If not (myString.contains("/") OrElse myString.contains("\") OrElse myString.contains("..")) then
  ...
end if

Is there a faster way to do this check using something like a character array??
0
Comment
Question by:Rouchie
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
7 Comments
 
LVL 143

Expert Comment

by:Guy Hengel [angelIII / a3]
ID: 18849541
>In an attempt to prevent querystring injection attacks, I need to check if a string contains a variety of characters.

note that if you used parametrized queries, you don't need to worry about any "weird" characters at all...

using System.Data.SqlClient
-> the objects to be used are
SqlCommand
SqlParameter

that will be much better than what you seem to try to do...
0
 
LVL 25

Author Comment

by:Rouchie
ID: 18849576
Hi angelIII

It's not actually database work that I'm doing.  I have a page that shows details for various products, passed to the page via the querystring,

     i.e.  mypage.aspx?product=productXYZ

I then save this value into a private property that is then referenced by multiple subs etc.  One of the things I need to do is dynamically show an image based on the product.  
So,

   mypage.aspx?product=productXYZ

is used to generate an ImageURL of

  /images/productXYZ.jpg

However I realise here that there is danger of manually re-writing the querystring to load in other images, so I need to restrict what is allowed when the property is read.

Does that make sense...?
0
 
LVL 143

Expert Comment

by:Guy Hengel [angelIII / a3]
ID: 18849603
ok.

you might consider using the LIKE keyword
If not (myString like "*[/\]*") Or myString like "*..*" ) then
  ...
end if

http://getdotnetco.web119.discountasp.net/GdncStore/free/Articles/Intoduction%20to%20the%20VB%20NET%20Like%20Operator.htm
0
Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

 
LVL 25

Author Comment

by:Rouchie
ID: 18849639
Okay I think I follow what you're saying.  Would it be possible to use this approach and make the process even simpler by saying something like this:

 if myString contains only [a-z] then
   ...
 end

I can't figure out if that's possible using LIKE.

Thanks.
0
 
LVL 143

Accepted Solution

by:
Guy Hengel [angelIII / a3] earned 500 total points
ID: 18849693
yes, with double negation:

If not (myString.ToLower like "*[^a-z]*") ) then
  ...
end if

so if there is nothing that is NOT a-z
0
 
LVL 2

Expert Comment

by:balochdude
ID: 18849704
Here is what i do when i dont want users to see whats going on in the querystring.

Response.Redirect(ResolveUrl("mypage.aspx?product=" & MySite.Security.EncryptText("productXYZ")))


Imports Microsoft.VisualBasic
Imports System.Text.RegularExpressions
Imports System
Imports System.IO
Imports System.Xml
Imports System.Text
Imports System.Security.Cryptography

Namespace MySite

Public Class Security

#Region " Encrypt/Decrypt "

        ''' <summary>
        ''' Encrypt the text
        ''' </summary>
        Public Shared Function EncryptText(ByVal strText As String, _
                Optional ByVal removePlus As Boolean = True) As String
            If removePlus Then
                Return Encrypt(strText, "%&#@?,:*").Replace("+", "|")
            Else
                Return Encrypt(strText, "%&#@?,:*")
            End If
        End Function

        ''' <summary>
        ''' Decrypt the text
        ''' </summary>
        Public Shared Function DecryptText(ByVal strText As String, _
                Optional ByVal removePlus As Boolean = True) As String
            If removePlus Then
                Return Decrypt(strText.Replace("|", "+"), "%&#@?,:*")
            Else
                Return Decrypt(strText, "%&#@?,:*")
            End If
        End Function

        ''' <summary>
        ''' The function used to encrypt the text
        ''' </summary>
        Private Shared Function Encrypt(ByVal strText As String, ByVal strEncrKey _
                 As String) As String
            Dim byKey() As Byte = {}
            Dim IV() As Byte = {&H12, &H34, &H56, &H78, &H90, &HAB, &HCD, &HEF}

            Try
                byKey = System.Text.Encoding.UTF8.GetBytes(Left(strEncrKey, 8))

                Dim des As New DESCryptoServiceProvider()
                Dim inputByteArray() As Byte = Encoding.UTF8.GetBytes(strText)
                Dim ms As New MemoryStream()
                Dim cs As New CryptoStream(ms, des.CreateEncryptor(byKey, IV), CryptoStreamMode.Write)
                cs.Write(inputByteArray, 0, inputByteArray.Length)
                cs.FlushFinalBlock()
                Return Convert.ToBase64String(ms.ToArray())

            Catch ex As Exception
                Return ex.Message
            End Try

        End Function

        ''' <summary>
        ''' The function used to decrypt the text
        ''' </summary>
        Private Shared Function Decrypt(ByVal strText As String, ByVal sDecrKey _
                   As String) As String
            Dim byKey() As Byte = {}
            Dim IV() As Byte = {&H12, &H34, &H56, &H78, &H90, &HAB, &HCD, &HEF}
            Dim inputByteArray(strText.Length) As Byte

            Try
                byKey = System.Text.Encoding.UTF8.GetBytes(Left(sDecrKey, 8))
                Dim des As New DESCryptoServiceProvider()
                inputByteArray = Convert.FromBase64String(strText)
                Dim ms As New MemoryStream()
                Dim cs As New CryptoStream(ms, des.CreateDecryptor(byKey, IV), CryptoStreamMode.Write)

                cs.Write(inputByteArray, 0, inputByteArray.Length)
                cs.FlushFinalBlock()
                Dim encoding As System.Text.Encoding = System.Text.Encoding.UTF8

                Return encoding.GetString(ms.ToArray())

            Catch ex As Exception
                Return ex.Message
            End Try

        End Function

#End Region

End Class

End Namespace
0
 
LVL 25

Author Comment

by:Rouchie
ID: 18850016
angelIII you are an absolute mine of knowledge!  Once again, thanks for help me out :-)
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In an ASP.NET application, I faced some technical problems. In this article, I list them out and show the solutions that I found.  I hope it will be useful. Problem: After closing a pop-up window, the parent page should be refreshed automaticall…
IntroductionWhile developing web applications, a single page might contain many regions and each region might contain many number of controls with the capability to perform  postback. Many times you might need to perform some action on an ASP.NET po…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question