The Lazy Programmer

Laziness is next to Godliness?

Loosely Coupled — Fri, 20 Nov 2009 14:53:35 GMT

Laziness is next to Godliness?

re: The Lazy Programmer

Jed Hunsaker — Sat, 10 Oct 2009 10:41:34 GMT

I've been trying to make this lazy vs. efficient argument forever! Glad to see someone else is on the same page as me :)

re: ASP.NET Request Validation and Cross-Site Scripting

TrackBack — Tue, 02 Mar 2004 13:38:00 GMT

re: The Lazy Programmer

Eli Robillard — Thu, 19 Feb 2004 14:06:00 GMT

Before anyone else bothers to post refinements to the code in this article, note that the point of the article is an approach to code construction. The point is not to provide best practises to prevent cross-site scripting or SQL injection attacks. The code samples describe progressively lazier solutions to a given problem; they exist only to illustrate the concept.

re: The Lazy Programmer

Mark — Sat, 14 Feb 2004 12:32:00 GMT

Long range lazyness... fantastic turn of phrase!

re: The Lazy Programmer

stefan demetz — Tue, 10 Feb 2004 08:14:00 GMT

only for scripts with angle bracktes , not for sql injection, param tampering et all

re: The Lazy Programmer

Eli Robillard — Wed, 04 Feb 2004 14:04:00 GMT

> it would be good if MS built in this input data cleansing in all input controls

They have! See the link at the end of the article on the RequestValidation feature. It checks GET or POST data for malicious content.

-e.

re: The Lazy Programmer

stefan demetz — Tue, 03 Feb 2004 23:47:00 GMT

it would be good if MS built in this input data cleansing in all input controls

Hardening ASP.NET - avoid SQL injection (ouch !!) - Part 2

TrackBack — Tue, 03 Feb 2004 23:41:00 GMT

re: The Lazy Programmer

Eli Robillard — Mon, 19 Jan 2004 02:10:00 GMT

True, and actually the username and password strings are not concatenated into SQL strings here. In fact, it never quite says exactly how they are used, only that they could carry malicious data.

In general, parameterised SQL queries are the recommended way to build any query with optional or variable input. Aside from providing a level of protection against SQL injection, SQL Server is smart enough to use the same compiled version of a parameterised query repeatedly, it's an easy performance gain.

A feature in ASP.NET 1.1 might be the laziest solution -- Request Validation. Read about it here: http://www.asp.net/faq/RequestValidation.aspx
Note that a patch should be applied: http://weblogs.asp.net/gad/archive/2003/11/12/37219.aspx