Improving Web Application Security: Threats and - CGISecurity

Chapter 12: Building Secure Web Services 329using System.Xml;using System.Xml.Schema;[WebMethod]public void OrderBooks(string xmlBookData){try{// Create and load a validating readerXmlValidatingReader reader = new XmlValidatingReader(xmlBookData,XmlNodeType.Element,null);// Attach the XSD schema to the readerreader.Schemas.Add("urn:bookstore-schema",@"http://localhost/WSBooks/bookschema.xsd");// Set the validation type for XSD schema.// XDR schemas and DTDs are also supportedreader.ValidationType = ValidationType.Schema;// Create and register an event handler to handle validation errorsreader.ValidationEventHandler += new ValidationEventHandler(ValidationErrors );// Process the input datawhile (reader.Read()){. . .}// Validation completed successfully}catch{. . .}}// Validation error event handlerprivate static void ValidationErrors(object sender, ValidationEventArgs args){// Error details available from args.Message. . .}The following fragment shows how the consumer calls the preceding Web method:string xmlBookData = "" +"Building Secure ASP.NET Applications" +"0735618909" +"1" +"";BookStore.BookService bookService = new BookStore.BookService();bookService.OrderBooks(xmlBookData));