Beginning Ajax With ASP.NET (2006).pdf

Chapter 2
Security Concerns When Getting Text Input
Because the name is written out exactly as it was entered, you want to be very careful when accepting
any assorted text from the user because exactly what someone types in is presented on the screen,
including any additional HTML or JavaScript. Try putting this in when prompted:
location.href=”http://www.wrox.com”;
When the page is rendered, the included script runs as part of the page and redirects the browser to the
Wrox web site! Although we love the Wrox web site, this is probably not at all what you intended when
you asked for the user’s name. So, taking this example further, what if you blindly stored the text from
the user in a database and then on the main page of your site presented a dynamic list of which users are
currently online? When that user is online, suddenly anyone who visits your site is redirected to another
page. This kind of attack is called HTML injection and is related to Cross Site Scripting (XSS). So to avoid
this problem, you need to include code to filter out unintentional HTML elements and JavaScript.
Conveniently, this kind of protection is intrinsic in Microsoft’s ASP.NET environment when using the
.NET Framework 1.1 or later.
Canceling the Normal Outcome of an Event
So, now you can look at another event handler called onclick. Every visible element found on an
HTML page provides this event handler, even the element. So, this really could be placed anywhere.
But people are more accustomed to clicking hyperlinks, so for this example you are going to
include this handler on an element that is used to navigate to other pages. What if you wanted to
confirm that people really wanted to navigate to another page when they clicked a link? Add this HTML
at the end of your current content to see how this is done:
Knowledge Base Software
The confirm() function presents a pop-up with both OK and Cancel buttons, as shown in Figure 2-4.
When a choice is made by the user, confirm() will equal true if the user clicks OK, or false if the user
clicks Cancel or closes the pop-up. Returning this true or false in an onclick event handler determines
if the handling of that event should continue or not.
18
Figure 2-4