ASP — Security

Input Validation

<%
Dim username
username = Request.Form("username")

' Validate
If Len(username) = 0 Then
    Response.Write("Username required")
End If
%>

SQL Injection Prevention

<%
' Bad - vulnerable to SQL injection
sql = "SELECT * FROM users WHERE name = '" & username & "'"

' Good - use parameterized queries
Set cmd = Server.CreateObject("ADODB.Command")
cmd.CommandText = "SELECT * FROM users WHERE name = ?"
cmd.Parameters.Append cmd.CreateParameter("name", 200, 1, 50, username)
%>

XSS Prevention

<%
' Encode output
Response.Write(Server.HTMLEncode(userInput))
%>

Session Security

<%
' Regenerate session ID
Session.Abandon
Session("authenticated") = True

' Set secure cookie
Response.Cookies("session").Secure = True
Response.Cookies("session").HttpOnly = True
%>

Security Checklist

Practice	Description
Validate input	Check all user data
Encode output	Prevent XSS
Use parameterized queries	Prevent SQL injection
Secure cookies	HttpOnly, Secure
Use HTTPS	Encrypt traffic

Mini Practice

1. Validate user input
2. Prevent SQL injection
3. Prevent XSS
4. Secure session cookies

Up Next

Continue with Error Handling — error handling.