Posted by david on 1. March 2009 14:04
Looking into form field validation for a friend. He’s running classic ASP to a SS2005 db - the problem at hand is how to validate a text field, comments, to make sure someone hasn’t plugged any nastiness into the string.
Before I realized he was coding with ASP, I looked at the ASP.NET 3.5 validator controls. Was pretty fun – here is my test page … using regular expressions to validate the input. There’s miles & miles more to do – but was a nice start.
Then I realized he was using ASP. I didn’t realize how different ASP was … never used it before, that I remember … so started plugging around.
SQL Injection in Classic ASP and Possible Solutions ASP Alliance
http://classicasp.aspfaq.com/
ASP Book by Charles Carroll
Turns out that asp.net is faster: “Pages with the .aspx extension are ASP.NET (based on Microsoft's .NET Framework) and compiled, which makes them faster and more robust than the than server-side scripting in ASP which is interpreted at run-time;” ( wikipedia “Classic ASP” )
But, others say .NET is too bloated ( though that seems, to me, an IDE issue ) :
8 Reasons to Stick with ASP 3.0 in 2006 (and 2007)
course, that was 2,3 years ago. This person is a little more blunt about the need to move on:
ASP is Dead - Microsoft Slit ASP’s Throat and Left it to Bleed Out… Stop Trying to Save it
I’ll have to ask ‘im why he’s still using it.
So
Wow, I went to my libraries online book site to look for classic asp books. I had to filter to books older than 2001. That’s some old sheet. ASP 3 was the last release of classic ASP.
Reselman, Bob. Active Server Pages 3.0 By Example. Que. © 2000. Books24x7. <http://common.books24x7.com/book/id_1444/book.asp> (accessed March 1, 2009)
MSDN: VBScript with regular expressions
Using VBScript with forms: Validating Your Forms
VBScript and Forms
He is passing the comment filed to a stored procedue, as a parameter, so we could make the SP handle the validation.
But would be cooler to have the control itself resist invalid characters.
Client-Side Form Field Validation with VBScript and ASP
good discussion of client vs server side validation, jquery, etc