Never Trust User Input: The ASP.NET ViewState case

re: Never Trust User Input: The ASP.NET ViewState case

Hernan de Lahitte — Fri, 06 May 2005 13:17:00 GMT

Sorry Scott about my sentence choice. However, I suggest you to polish your writing style so your boss won't feel sick when reviewing you. :-)

re: Never Trust User Input: The ASP.NET ViewState case

Daniel Auger — Wed, 04 May 2005 16:01:00 GMT

Server-side viewstate is another option.
http://msdn.microsoft.com/msdnmag/issues/03/02/CuttingEdge/
In that article, if I remember correctly, he stores thew viewstate in a file on the server, but it is very easy to convert the example to use a session variable for the viewstate.

re: Never Trust User Input: The ASP.NET ViewState case

Scott Mitchell — Wed, 04 May 2005 15:52:00 GMT

Eep, you chose to summarize my article with the worst sentence in the entire entry! Chalk full of parenthetical side comments and a bit of a run-on... if I wrote this in a book my editor would likely vomit all over his keyboard.

Wally, what was your client's rationale for NOT requerying the database for pricing data? Was it solely because of performance reasons?

re: Never Trust User Input: The ASP.NET ViewState case

Wallym — Wed, 04 May 2005 13:19:00 GMT

I agree with you. :-) However, I had a customer that was adament that they would not requery the database for pricing information. They believed that their situation was valid. Its a battle I lost, though I did state that I felt that their reasons were not valid.