Click here to Skip to main content
       

ASP.NET

 
Answerrelated to itext sharp-iText use for commercial purpose PinmemberAbhishek Pant6-Feb-13 19:07 
AnswerRe: related to itext sharp PinmvpSandeep Mewara2-Feb-13 0:24 
QuestionDisplay image using handler.ashx what wrong my code PinmemberMichael511931-Jan-13 20:43 
AnswerRe: Display image using handler.ashx what wrong my code PinmemberRichard Deeming1-Feb-13 2:17 
Apart from the fact that you're not setting the ContentType[^] of the response, you have a SQL injection vulnerability[^] in your code:
string imageid = context.Request.QueryString["UserID"];
...
new SqlCommand("select UserID,Image FROM Users where UserID=" + imageid, connection);
Anyone with access to your site could call Handler.ashx?UserID=1;DELETE FROM Users;, and your code would happily execute two queries: one to select the image for UserID 1, and one to delete all records from the Users table.
 
Change your code to use a parameterized query:
public sealed class Handler : IHttpHandler
{
    public void ProcessRequest(HttpContext context)
    {
        string imageid = context.Request.QueryString["UserID"];
        string connectionString = ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString;
 
        // Use "using" blocks to clean up automatically:
        using (SqlConnection connection = new SqlConnection(connectionString))
        using (SqlCommand command = new SqlCommand("SELECT UserID, Image FROM Users WHERE UserID = @UserID", connection))
        {
            // Use a parameterized query to avoid SQL injection:
            command.Parameters.AddWithValue("@UserID", imageid);
 
            connection.Open();
            using (SqlDataReader dr = command.ExecuteReader(CommandBehavior.CloseConnection))
            {
                // The image might not exist!
                if (!dr.Read()) throw new HttpException(404, "Image not found.");
 
                // Add the correct type here:
                context.Response.ContentType = "image/jpeg";
                context.Response.BinaryWrite((byte[])dr[dr.GetOrdinal("Image")]);
            }
        }
    }
 
    public bool IsReusable
    {
        get { return true; }
    }
}



"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer


GeneralRe: Display image using handler.ashx what wrong my code PinmemberMichael51191-Feb-13 4:16 
GeneralRe: Display image using handler.ashx what wrong my code PinmemberRichard Deeming1-Feb-13 5:36 
GeneralRe: Display image using handler.ashx what wrong my code PinmemberMichael51191-Feb-13 5:58 
GeneralRe: Display image using handler.ashx what wrong my code PinmemberMichael51191-Feb-13 7:03 
GeneralRe: Display image using handler.ashx what wrong my code PinmemberRichard Deeming1-Feb-13 8:12 
GeneralRe: Display image using handler.ashx what wrong my code PinmemberMichael51198-Feb-13 20:10 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.


Advertise | Privacy | Mobile
Web03 | 2.8.140916.1 | Last Updated 19 Sep 2014
Copyright © CodeProject, 1999-2014
All Rights Reserved. Terms of Service
Layout: fixed | fluid