Click here to Skip to main content
15,886,258 members
Home / Discussions / ASP.NET
   

ASP.NET

 
GeneralRe: related to itext sharp Pin
Member 97985416-Feb-13 17:41
Member 97985416-Feb-13 17:41 
GeneralRe: related to itext sharp Pin
Abhishek Pant6-Feb-13 18:09
professionalAbhishek Pant6-Feb-13 18:09 
GeneralRe: related to itext sharp Pin
Member 97985416-Feb-13 19:21
Member 97985416-Feb-13 19:21 
GeneralRe: related to itext sharp Pin
Member 97985416-Feb-13 18:08
Member 97985416-Feb-13 18:08 
Answerrelated to itext sharp-iText use for commercial purpose Pin
Abhishek Pant6-Feb-13 19:07
professionalAbhishek Pant6-Feb-13 19:07 
AnswerRe: related to itext sharp Pin
Sandeep Mewara2-Feb-13 0:24
mveSandeep Mewara2-Feb-13 0:24 
QuestionDisplay image using handler.ashx what wrong my code Pin
Michael†Cheong31-Jan-13 20:43
Michael†Cheong31-Jan-13 20:43 
AnswerRe: Display image using handler.ashx what wrong my code Pin
Richard Deeming1-Feb-13 2:17
mveRichard Deeming1-Feb-13 2:17 
Apart from the fact that you're not setting the ContentType[^] of the response, you have a SQL injection vulnerability[^] in your code:
C#
string imageid = context.Request.QueryString["UserID"];
...
new SqlCommand("select UserID,Image FROM Users where UserID=" + imageid, connection);

Anyone with access to your site could call Handler.ashx?UserID=1;DELETE FROM Users;, and your code would happily execute two queries: one to select the image for UserID 1, and one to delete all records from the Users table.

Change your code to use a parameterized query:
C#
public sealed class Handler : IHttpHandler
{
    public void ProcessRequest(HttpContext context)
    {
        string imageid = context.Request.QueryString["UserID"];
        string connectionString = ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString;

        // Use "using" blocks to clean up automatically:
        using (SqlConnection connection = new SqlConnection(connectionString))
        using (SqlCommand command = new SqlCommand("SELECT UserID, Image FROM Users WHERE UserID = @UserID", connection))
        {
            // Use a parameterized query to avoid SQL injection:
            command.Parameters.AddWithValue("@UserID", imageid);

            connection.Open();
            using (SqlDataReader dr = command.ExecuteReader(CommandBehavior.CloseConnection))
            {
                // The image might not exist!
                if (!dr.Read()) throw new HttpException(404, "Image not found.");

                // Add the correct type here:
                context.Response.ContentType = "image/jpeg";
                context.Response.BinaryWrite((byte[])dr[dr.GetOrdinal("Image")]);
            }
        }
    }

    public bool IsReusable
    {
        get { return true; }
    }
}




"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer


GeneralRe: Display image using handler.ashx what wrong my code Pin
Michael†Cheong1-Feb-13 4:16
Michael†Cheong1-Feb-13 4:16 
GeneralRe: Display image using handler.ashx what wrong my code Pin
Richard Deeming1-Feb-13 5:36
mveRichard Deeming1-Feb-13 5:36 
GeneralRe: Display image using handler.ashx what wrong my code Pin
Michael†Cheong1-Feb-13 5:58
Michael†Cheong1-Feb-13 5:58 
GeneralRe: Display image using handler.ashx what wrong my code Pin
Michael†Cheong1-Feb-13 7:03
Michael†Cheong1-Feb-13 7:03 
GeneralRe: Display image using handler.ashx what wrong my code Pin
Richard Deeming1-Feb-13 8:12
mveRichard Deeming1-Feb-13 8:12 
GeneralRe: Display image using handler.ashx what wrong my code Pin
Michael†Cheong8-Feb-13 20:10
Michael†Cheong8-Feb-13 20:10 
GeneralRe: Display image using handler.ashx what wrong my code Pin
Richard Deeming11-Feb-13 1:29
mveRichard Deeming11-Feb-13 1:29 
QuestionImagesIn Gridview Pin
m.sutarmahesh31-Jan-13 20:13
m.sutarmahesh31-Jan-13 20:13 
QuestionImporting Excel into Gridview, doesn't import all rows Pin
Craist31-Jan-13 8:29
Craist31-Jan-13 8:29 
AnswerRe: Importing Excel into Gridview, doesn't import all rows Pin
Craist31-Jan-13 9:22
Craist31-Jan-13 9:22 
QuestionWeb Pages Authentication Pin
Jassim Rahma30-Jan-13 21:22
Jassim Rahma30-Jan-13 21:22 
AnswerRe: Web Pages Authentication Pin
Rahul Rajat Singh30-Jan-13 22:14
professionalRahul Rajat Singh30-Jan-13 22:14 
QuestionAuthentication with database MVC4 Pin
AghaKhan30-Jan-13 20:44
AghaKhan30-Jan-13 20:44 
QuestionAutocomplete List hides behind Grid's horizontal scrollbar Pin
Ponka_developer30-Jan-13 12:01
Ponka_developer30-Jan-13 12:01 
AnswerRe: Autocomplete List hides behind Grid's horizontal scrollbar Pin
jkirkerx30-Jan-13 12:50
professionaljkirkerx30-Jan-13 12:50 
QuestionMessage Removed Pin
29-Jan-13 4:39
professionalN_tro_P29-Jan-13 4:39 
QuestionHow to create and get the user input in alert message in asp.net webservice Pin
Rocky2327-Jan-13 22:22
Rocky2327-Jan-13 22:22 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.