How to use string.contains with a character array?

In an attempt to prevent querystring injection attacks, I need to check if a string contains a variety of characters.

Currently I have this...

If not (myString.contains("/") OrElse myString.contains("\") OrElse myString.contains("..")) then
  ...
end if

Is there a faster way to do this check using something like a character array??
LVL 25
RouchieAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Guy Hengel [angelIII / a3]Billing EngineerCommented:
>In an attempt to prevent querystring injection attacks, I need to check if a string contains a variety of characters.

note that if you used parametrized queries, you don't need to worry about any "weird" characters at all...

using System.Data.SqlClient
-> the objects to be used are
SqlCommand
SqlParameter

that will be much better than what you seem to try to do...
0
RouchieAuthor Commented:
Hi angelIII

It's not actually database work that I'm doing.  I have a page that shows details for various products, passed to the page via the querystring,

     i.e.  mypage.aspx?product=productXYZ

I then save this value into a private property that is then referenced by multiple subs etc.  One of the things I need to do is dynamically show an image based on the product.  
So,

   mypage.aspx?product=productXYZ

is used to generate an ImageURL of

  /images/productXYZ.jpg

However I realise here that there is danger of manually re-writing the querystring to load in other images, so I need to restrict what is allowed when the property is read.

Does that make sense...?
0
Guy Hengel [angelIII / a3]Billing EngineerCommented:
ok.

you might consider using the LIKE keyword
If not (myString like "*[/\]*") Or myString like "*..*" ) then
  ...
end if

http://getdotnetco.web119.discountasp.net/GdncStore/free/Articles/Intoduction%20to%20the%20VB%20NET%20Like%20Operator.htm
0
Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

RouchieAuthor Commented:
Okay I think I follow what you're saying.  Would it be possible to use this approach and make the process even simpler by saying something like this:

 if myString contains only [a-z] then
   ...
 end

I can't figure out if that's possible using LIKE.

Thanks.
0
Guy Hengel [angelIII / a3]Billing EngineerCommented:
yes, with double negation:

If not (myString.ToLower like "*[^a-z]*") ) then
  ...
end if

so if there is nothing that is NOT a-z
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
balochdudeCommented:
Here is what i do when i dont want users to see whats going on in the querystring.

Response.Redirect(ResolveUrl("mypage.aspx?product=" & MySite.Security.EncryptText("productXYZ")))


Imports Microsoft.VisualBasic
Imports System.Text.RegularExpressions
Imports System
Imports System.IO
Imports System.Xml
Imports System.Text
Imports System.Security.Cryptography

Namespace MySite

Public Class Security

#Region " Encrypt/Decrypt "

        ''' <summary>
        ''' Encrypt the text
        ''' </summary>
        Public Shared Function EncryptText(ByVal strText As String, _
                Optional ByVal removePlus As Boolean = True) As String
            If removePlus Then
                Return Encrypt(strText, "%&#@?,:*").Replace("+", "|")
            Else
                Return Encrypt(strText, "%&#@?,:*")
            End If
        End Function

        ''' <summary>
        ''' Decrypt the text
        ''' </summary>
        Public Shared Function DecryptText(ByVal strText As String, _
                Optional ByVal removePlus As Boolean = True) As String
            If removePlus Then
                Return Decrypt(strText.Replace("|", "+"), "%&#@?,:*")
            Else
                Return Decrypt(strText, "%&#@?,:*")
            End If
        End Function

        ''' <summary>
        ''' The function used to encrypt the text
        ''' </summary>
        Private Shared Function Encrypt(ByVal strText As String, ByVal strEncrKey _
                 As String) As String
            Dim byKey() As Byte = {}
            Dim IV() As Byte = {&H12, &H34, &H56, &H78, &H90, &HAB, &HCD, &HEF}

            Try
                byKey = System.Text.Encoding.UTF8.GetBytes(Left(strEncrKey, 8))

                Dim des As New DESCryptoServiceProvider()
                Dim inputByteArray() As Byte = Encoding.UTF8.GetBytes(strText)
                Dim ms As New MemoryStream()
                Dim cs As New CryptoStream(ms, des.CreateEncryptor(byKey, IV), CryptoStreamMode.Write)
                cs.Write(inputByteArray, 0, inputByteArray.Length)
                cs.FlushFinalBlock()
                Return Convert.ToBase64String(ms.ToArray())

            Catch ex As Exception
                Return ex.Message
            End Try

        End Function

        ''' <summary>
        ''' The function used to decrypt the text
        ''' </summary>
        Private Shared Function Decrypt(ByVal strText As String, ByVal sDecrKey _
                   As String) As String
            Dim byKey() As Byte = {}
            Dim IV() As Byte = {&H12, &H34, &H56, &H78, &H90, &HAB, &HCD, &HEF}
            Dim inputByteArray(strText.Length) As Byte

            Try
                byKey = System.Text.Encoding.UTF8.GetBytes(Left(sDecrKey, 8))
                Dim des As New DESCryptoServiceProvider()
                inputByteArray = Convert.FromBase64String(strText)
                Dim ms As New MemoryStream()
                Dim cs As New CryptoStream(ms, des.CreateDecryptor(byKey, IV), CryptoStreamMode.Write)

                cs.Write(inputByteArray, 0, inputByteArray.Length)
                cs.FlushFinalBlock()
                Dim encoding As System.Text.Encoding = System.Text.Encoding.UTF8

                Return encoding.GetString(ms.ToArray())

            Catch ex As Exception
                Return ex.Message
            End Try

        End Function

#End Region

End Class

End Namespace
0
RouchieAuthor Commented:
angelIII you are an absolute mine of knowledge!  Once again, thanks for help me out :-)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
ASP.NET

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.