Creating comment box for authenticated users (vb)

[Ling]

Good afternoon everyone,

 

I am using visual studio 2008 coding in vb, i have created a comment box which currently works where a user can type in thier name and leave a comment. What I would like to do is ensure that the user is logged in before they can leave a comment? If the user is not logged in then they can only view the comments posted.

 

Any advice and help is appreciated, thank you

 

Ling

[Andrew Westgarth]

Ling,

       you could add something similar to this for checking to see if the user is authenticated and then enable any controls/panels based on whether they are logged in or not, put this in your page_load event:

If (HttpContext.Current.User.Identity.IsAuthenticated()) Then

pnlCommentEntry.Visible = True

Else

pnlCommentEntry.Visible = False

End If

Cheers

Andrew
Andrew Westgarth
VBUG North East Regional Coordinator - nort...@vbug.co.uk
VBUG - Developing the Developer! - http://www.vbug.net

MVP for Internet Information Services (IIS) - https://mvp.support.microsoft.com/profile/Andrew.Westgarth

Blog: http://www.andrewwestgarth.co.uk/blog
Twitter: http://www.twitter.com/apwestgarth
Live Id: ma...@hawaythelads.co.uk (Nickname: The Code Monkey)
Skype id: andrewwestgarth

[Ling]

Hello Andrew,

 

This is my code:

 

<%@ Page Title="" Language="VB" MasterPageFile="~/MasterPage.master" AutoEventWireup="false" CodeFile="comments.aspx.vb" Inherits="comments" %>

<asp:Content ID="Content1" ContentPlaceHolderID="ContentPlaceHolder1" Runat="Server">

 

<asp:ScriptManager ID="ScriptManager1" runat="server" />

<asp:UpdatePanel ID="UpdatePanel1" runat="server">
<ContentTemplate>

<asp:DataGrid ID="DataGrid1" runat="server" DataSourceID="SqlDataSource1"
Width="600px" PageSize="6" AllowPaging="True">
    <HeaderStyle Font-Bold="True" Font-Italic="False" Font-Overline="False"
        Font-Size="Medium" Font-Strikeout="False" Font-Underline="False"
        HorizontalAlign="Center" />
</asp:DataGrid>

<asp:FormView ID="FormView1" runat="server" DataSourceID="SqlDataSource1" DefaultMode="Insert">
<InsertItemTemplate>
<label>Name:</label><asp:TextBox ID="txtName" runat="server" Text='<%# Bind("name") %>'/>
<label>Comments:</label><br /><asp:TextBox ID="txtComments" runat="server" Columns="80"
Rows="8" TextMode="MultiLine" Text='<%# Bind("comments") %>'/>
<asp:HiddenField ID="hidDate" runat="server" Value='<%# Bind("date") %>' />
<br /><asp:Button ID="butSubmit" runat="server" CommandName="Insert" Text="Submit" />
</InsertItemTemplate>
</asp:FormView>

</ContentTemplate>
</asp:UpdatePanel>

<asp:SqlDataSource ID="SqlDataSource1" runat="server"
ConnectionString="<%$ ConnectionStrings:ConnectionString %>"
SelectCommand="SELECT tblRegister.Forename, tblComments.Comments, tblComments.Date FROM tblComments INNER JOIN tblregcom ON tblComments.ID = tblregcom.id INNER JOIN tblRegister ON tblregcom.reg_id = tblRegister.Reg_id ORDER BY tblComments.ID DESC"

        InsertCommand="INSERT tblComments (name,comments,date) VALUES (@name, @comments, @date)">
    <InsertParameters>
        <asp:Parameter Name="name" />
        <asp:Parameter Name="comments" />
        <asp:Parameter Name="date" />
    </InsertParameters>
    </asp:SqlDataSource>

</asp:Content>

 

When you wrote: pnlCommentEntry do i need to change this to .....UpdatePanel1?

[Andrew Westgarth (VBUG North East)]

Linq,
no, use something like this:

Protected Sub Page_Load(ByVal sender As Object, ByVal e As
System.EventArgs) Handles Me.Load
If (HttpContext.Current.User.Identity.IsAuthenticated()) Then
FormView1.DefaultMode = FormViewMode.Insert
Else
FormView1.Visible = False
End If
End Sub

Control the FormView in the way you want it to be handled. If you
don't want the user who is not authenticated to be able to see the
FormView set it to be invisible and it won't be rendered, and
alternative you could do is set FormView1.DefaultMode =
FormViewMode.ReadOnly.

Hope this helps.

Andrew

[Ross Dargan]

lol. I just googled lovelingy... I hope the first result isn't you! rofl.

anyway no its not the update panel you should disable (I hate update panels if you don't know what it does don't use it!).

Its your formview you should disable FormView1

Ross

[Steven Woods]

Probably worth mentioning that you should be sanitising ALL of the data that is entered; you're wide open to SQL Injection with that code as it stands. For instance if someone enters " ';DROP *; " (or equivalent) into your Name field at the moment, your database tables and data will be gone.

Steve W

2009/11/19 Ross Dargan <ross....@gmail.com>

[Steven Woods]

...or maybe not since I noticed you're using parameterised SQL, but still good practice anyway

2009/11/19 Steven Woods <st...@swoo.co.uk>

[Ling]

Hey Andrew,

 

Yes this worked perfectly fine, i can only see the comments posted as requested. I think i am doing this backwards lol anyway i have a login.aspx which checks if a user is registered (tblRegister) if it is then it will log them in and then i have redirected them to the comment part and it does not enable them to leave comments. Am i doing something wrong ? Thank you so much for helping.

 

Ling

[Ling]

Lol no that isn't me haha hm...curious as to why u googled lovelingy?? lol funny

[Ling]

Hi Steven,

 

Thank you for your advice, i understand what you mean by sql injection and how vulnerable a database can be if not protected :) At least you have reassured me that it will be ok , thank you

[Ross Dargan]

Your email address is lovelingy@goo.... I just wanted to see who was the man behind the question!

Would have been much better if it was you!

A quicker way to get answers might be to use stackoverflow.com. Its an excellent place to get questions like this answered very quickly.

Thanks

[Steven Woods]

Ling I'd still be checking the data before you stick it in your database ... for instance if someone enters <script type='text/javascript'>document.location.href('mydodgysite.com');</script> into the name field, and your page pulls that out of your database then writes it onto your page, the user (and every subsequent user) will be redirected to that URL whenever that "name" is displayed on the page!

At the very least, you should look at encoding the data before it is displayed. Something like =Html.Encode(myStringValue); (but the VB equivalent). That'll stop people getting sneaky HTML.onto your pages.

S

2009/11/19 Ross Dargan <ross....@gmail.com>

[Ling]

Oh right, ok i will do that also :) Is there any books you recommend me owning/reading?

[Ling]

Lol oh right , quite funny how a guy is also called lovelingy tho lol I'll have a look at that link also

[Chris Neale]

HTML encoding the input data isn't enough to prevent a well crafted XSS attack - http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#Why_Can.27t_I_Just_HTML_Entity_Encode_Untrusted_Data.3F

Might I suggest we create a "Supermondays Technical" mailing list for this sort of discussion? Not everyone whom attends is a developer. This list should be limited to discussing SuperMondays things (in my opinion).

C

[Seraphim]

Yes, good idea, Chris

"some" of us are not developers, so a "Supermondays Technical" mailing
list is very welcome

Seraphim
--

2009/11/20 Chris Neale <oni...@gmail.com>:

[Ross Cooney]

Hi All,

2009/11/20 Seraphim <s.alv...@googlemail.com>:

>
> Yes, good idea, Chris
>
> "some" of us are not developers, so a "Supermondays Technical" mailing
> list is very welcome

Good ideas..but, rather than setup a new SuperMondays mailing list
perhaps we should refer technical questions to some of the other lists
that are already setup in the region.

For example, the LUG run a very successful mailing list for linux
questions, Refresh Newcastle and Refresh Teesside run a great web
developer lists and I guess that Vbug does a Microsoft one too. We
should compile a list.

--
Ross Cooney
www.emailcloud.com

Rozmic Wireless Limited
Gateshead int'l Business Centre
Mulgrave Terrace
Gateshead
NE8 1AN
United Kingdom.
Tel: 0845 130 5523

[Alex Kavanagh]

Ross Cooney wrote, On 20/11/09 11:54:

Hi All,

2009/11/20 Seraphim <s.alv...@googlemail.com>:
  

Yes, good idea, Chris

"some" of us are not developers, so a "Supermondays Technical" mailing
list is very welcome
    

Good ideas..but, rather than setup a new SuperMondays mailing list
perhaps we should refer technical questions to some of the other lists
that are already setup in the region.

For example, the LUG run a very successful mailing list for linux
questions, Refresh Newcastle and Refresh Teesside run a great web
developer lists and I guess that Vbug does a Microsoft one too. We
should compile a list.
  

Ross, that is an excellent idea.  As this was mostly a Microsoft technology thread I guess it would have been idea on the VBug list?  Any VBug list people agree/disagree?

Cheers
Alex.

[Andrew Westgarth (VBUG North East)]

Ross,
when VBUG was establised back in 1996 we did run our own
Forums however these tailed off as the prevalence of better supported
online forums/communities developed. I'd recommend from a MS
viewpoint and indeed for most platforms that now StackOverflow
(www.stackoverflow.com) should be the first port of call for technical
questions. Alternatives would be forums.asp.net; forums.iis.net etc.

Cheers

Andrew

Andrew Westgarth
VBUG North East Regional Coordinator - nort...@vbug.co.uk
VBUG - Developing the Developer! - http://www.vbug.net

MVP for Internet Information Services (IIS) -
https://mvp.support.microsoft.com/profile/Andrew.Westgarth

Blog: http://www.andrewwestgarth.co.uk/blog
Twitter: http://www.twitter.com/apwestgarth
Live Id: ma...@hawaythelads.co.uk (Nickname: The Code Monkey)
Skype id: andrewwestgarth

On Nov 20, 11:54 am, Ross Cooney <ross.coo...@gmail.com> wrote:
> Hi All,
>
> 2009/11/20 Seraphim <s.alvani...@googlemail.com>:

[Ross Cooney]

Does anybody want to create a page on the SuperMondays Google group
and start to compile this list?

Ross

2009/11/20 Andrew Westgarth (VBUG North East) <ma...@hawaythelads.co.uk>:

--
Ross Cooney