Re: [WebDNA] PCI Vulnerability testing

This WebDNA talk-list message is from

2009


It keeps the original formatting.
numero = 102401
interpreted = N
texte = [text][url][name][/url]=[input][value][/input][/text] ^^^ This line is used to totally clean the input. WebDNA manages variables in different levels. Whatever level you are in right now will use the most recently declared set of variables. A level can be viewed as any looping construct, like [loop] or [founditems], etc... So here's how that line of code works... [formvariables] will give you all the variables incoming to the page. You can then create another set of identical variables with the same name using [url][name][/url]. This new set of variables will become the actual variables that are used on the page, instead of the [formvariables]. When you [url] all of the names you effectively kill all attacks because all the bad characters are converted to url'd values. The re-declaration of all the variables will not hurt your variables in any way since normal variable names don't have strange characters... so they pass right through unharmed. Matthew A Perosi JewelerWebsites.com ------------------------------by Psi Prime------- Senior Web Developer 323 Union Blvd. Totowa, NJ 07512 Pre-Sales: 888.872.0274 Service: 973.413.8213 Training: 973.413.8214 Fax: 973.413.8217 http://www.jewelerwebsites.com http://en.wikipedia.org/wiki/Psi_Prime%2C_Inc http://www.psiprime.com Govinda wrote: > > On Apr 13, 2009, at 1:35 PM, Psi Prime, Matthew A Perosi wrote: > >> This seems to work for me. >> It seems to stand up to the attacks from McAfee Secure >> >> [formvariables] >> [showif [url][name][/url]^script>][redirect /index.html][/showif] >> [showif [url][name][/url]^iframe][redirect /index.html][/showif] > >> >> [text][url][name][/url]=[input][value][/input][/text] > > what is this line ^^^ for in this context? > >> >> [/formvariables] >> [showif [countchars][cart][/countchars]>18][redirect >> /index.html][/showif] >> >> Associated Messages, from the most recent to the oldest:

    
  1. Re: [WebDNA] PCI Vulnerability testing ("Psi Prime, Matthew A Perosi " 2009)
  2. Re: [WebDNA] PCI Vulnerability testing (Jeffrey Jones 2009)
  3. Re: [WebDNA] PCI Vulnerability testing ("Psi Prime, Matthew A Perosi " 2009)
  4. Re: [WebDNA] PCI Vulnerability testing (William DeVaul 2009)
  5. Re: [WebDNA] PCI Vulnerability testing (Jeffrey Jones 2009)
  6. Re: [WebDNA] PCI Vulnerability testing ("Psi Prime, Matthew A Perosi " 2009)
  7. Re: [WebDNA] PCI Vulnerability testing (Govinda 2009)
  8. Re: [WebDNA] PCI Vulnerability testing ("Psi Prime, Matthew A Perosi " 2009)
  9. Re: [WebDNA] PCI Vulnerability testing (Govinda 2009)
  10. Re: [WebDNA] PCI Vulnerability testing ("Psi Prime, Matthew A Perosi " 2009)
  11. Re: [WebDNA] PCI Vulnerability testing (William DeVaul 2009)
  12. Re: [WebDNA] PCI Vulnerability testing (Govinda 2009)
  13. Re: [WebDNA] PCI Vulnerability testing (Marc Thompson 2009)
  14. Re: [WebDNA] PCI Vulnerability testing (William DeVaul 2009)
  15. [WebDNA] PCI Vulnerability testing (Bob Minor 2009)
[text][url][name][/url]=[input][value][/input][/text] ^^^ This line is used to totally clean the input. WebDNA manages variables in different levels. Whatever level you are in right now will use the most recently declared set of variables. A level can be viewed as any looping construct, like [loop] or [founditems], etc... So here's how that line of code works... [formvariables] will give you all the variables incoming to the page. You can then create another set of identical variables with the same name using [url][name][/url]. This new set of variables will become the actual variables that are used on the page, instead of the [formvariables]. When you [url] all of the names you effectively kill all attacks because all the bad characters are converted to url'd values. The re-declaration of all the variables will not hurt your variables in any way since normal variable names don't have strange characters... so they pass right through unharmed. Matthew A Perosi JewelerWebsites.com ------------------------------by Psi Prime------- Senior Web Developer 323 Union Blvd. Totowa, NJ 07512 Pre-Sales: 888.872.0274 Service: 973.413.8213 Training: 973.413.8214 Fax: 973.413.8217 http://www.jewelerwebsites.com http://en.wikipedia.org/wiki/Psi_Prime%2C_Inc http://www.psiprime.com Govinda wrote: > > On Apr 13, 2009, at 1:35 PM, Psi Prime, Matthew A Perosi wrote: > >> This seems to work for me. >> It seems to stand up to the attacks from McAfee Secure >> >> [formvariables] >> [showif [url][name][/url]^script>][redirect /index.html][/showif] >> [showif [url][name][/url]^iframe][redirect /index.html][/showif] > >> >> [text][url][name][/url]=[input][value][/input][/text] > > what is this line ^^^ for in this context? > >> >> [/formvariables] >> [showif [countchars][cart][/countchars]>18][redirect >> /index.html][/showif] >> >> "Psi Prime, Matthew A Perosi "

DOWNLOAD WEBDNA NOW!

Top Articles:

Talk List

The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...

Related Readings:

FOUND: WebCatalog Review by Mike Heck (2001) frames & carts (1997) WebCat2 beta FTP site (1997) carriage returns in data (1997) $purchase WITHOUT creditcar (1997) Sendmail Excel Attachment (2006) Adding Message to Order (1997) Re:Emailer and encryption (1997) Strange intermittent WebDNA problems (2008) a search based on ^(contains) (1998) Help!!!! (1997) Alternating colors (1997) Supressing Error Messages (1998) customer info (2001) [shownext max=?] armed (1997) How to download a database???/ (2000) Which beta for w* 4.1 and a problem w/b12 (1999) WC1.6 to WC2 date formatting -FIXED! (1997) ooops...WebCatalog [FoundItems] Problem - LONG - (1997) Multiple prices (1997)