Client Variable Enables Cross-Site Scripting

.ASP page

Developers may need to debug "app-generated" SQL

if (Request("t") = "dump") then
	'Debugging.
	Response.Write strSQL
end if
'Run the query
rs.Open strSQL, DataConn, adOpenStatic, adLockReadOnly
if (Request("t") = "dump") then
	'Debugging.
	dumprecordset rs
end if

But wait! SQL injection elsewhere allows me to submit HTML to database!

Navigational Aids
Back

This page is maintained by Foofus.
Send comments or questions to foofus@foofus.net.

Client Variable Enables Cross-Site Scripting

.ASP page

Developers may need to debug "app-generated" SQL

But wait! SQL injection elsewhere allows me to submit HTML to database!