Security & DHTML Editors

[FP2003]

I'm finishing up on a site and the owner has asked that users be allowed to
upload news articles into a form page.

The form page has a DHTML text editor on it that submits to the Access
database.

I was curious to know if it was possible for a user to upload malicious code
into the database this way.

The field being utilized is a memo field with a 30K character limit set on
it.

Using: FrontPage2003/Access & Win2K server

Thanks

 

[FP2003]

Clarification: the owner has asked that users be allowed to upload news
articles into the database using a form page.

 

[clintonG]

Google: form cross site scripting
Google: form sql injection attack


<%= Clinton Gallagher
METROmilwaukee (sm) "A Regional Information Service"
NET csgallagher AT metromilwaukee.com
URL http://metromilwaukee.com/
URL http://clintongallagher.metromilwaukee.com/

 

[FP2003]

WOW !

Great lesson...thanks

Google: form cross site scripting
Google: form sql injection attack


<%= Clinton Gallagher
METROmilwaukee (sm) "A Regional Information Service"
NET csgallagher AT metromilwaukee.com
URL http://metromilwaukee.com/
URL http://clintongallagher.metromilwaukee.com/