SQL Injection-proof your integrated SQL search in ASP.NET 2.0

31 10 2007

I had forgotten to add SQL Injection prevention logic when I integrated and implemented a SQL search function for my employer’s internal ASP.NET app.  So in this post, I’m adding it for archival and sharing purposes.

SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution.

BTW, here’s an excellent article about SQL Injection on the MSDN site. 

1. The first thing you’ll need to do is grab the user’s input from the search textbox; for example:

// Get user search input
string requestString = txtSearch.Text.Trim(null);

2. Next, you’ll need to add logic to see if the user input contains any of the following:

image

I added something like this:


if ((requestString.Contains(";")) || (requestString.Contains("'")) ||
    (requestString.Contains("--")) || (requestString.Contains("/*")) ||
    (requestString.Contains("*/")) || (requestString.Contains("xp_")))
{
    // Stop processing and notify user
}
else
{
    // Continue processing and show results
}

3. Build/compile your app then test it out.  If all goes well, you should not get any errors and your web app’s search function should now be SQL Injection-proof.



The complete guide to Mac/Windows Interoperability

19 10 2007

Here’s an excellent post from Lifehacker, the Geek To Live site, that shows you how to make Mac OS and Windows work together in harmony.

It covers file sharing, file and application compatibility, file sync and system files, printer and fax sharing, running Windows on your Mac, remote server access, and finally iTunes and your iPod.  It ends with a comprehensive guide to switching to a Mac.

Sweet!  =0)



Print Screen in Mac OS X under Parallels

19 10 2007

If you’re a Mac convert using Parallels to run Windows, you’re probably wondering where the Print Screen (used for screen captures in Windows) OS X is.  Well, unfortunately, there’s no exact keyboard stroke for it; however equivalent; however, you can either use a third-party app like SnagIT, or go the smarter route by using the Windows built-in On-Screen Keyboard tool. 

To access it:

1. Go to Start > Run.

2. Type osk then hit Enter.

If all went well, you should see something like this:

image

Voila!  You can click the psc key to copy any image (e.g., your desktop) into the [Windows] clipboard, which you can then paste into MS Paint to manipulate to your liking. 

Hope this tip helps.



Computer program detects author gender

17 10 2007

I read an excerpt at the Nature website by Phillip Ball, wherein a computer program, developed by Moshe Koppel and his colleagues, can guess/tell whether the author [of a book] was written by a man or a woman.  It’s algorithm (see below), says Ball, basically scans for keywords and syntax to accomplish this feat, and is surprisingly “around 80 percent accurate.”

Ball states:

The program’s success seems to confirm the stereotypical perception of differences in male and female language use.  Crudely put, men talk about objects, and women more about relationships.  Female writers use more pronouns (I, you, she, their, myself), say the program’s developers, Moshe Koppel, and colleagues.  Males prefer words that identify or determine nouns (a, the, that) and words that quantify them (one, two, more).

There’s also a Perl module on CPAN called Lingua::EN::Gender that uses the algorithm below.

Moshe Koppel and colleague’s algorithm

Take any piece of fiction and do the following:

1. Count the number of words in the document.

2. For each appearance in the document of the following words ADD the number of points indicated:
‘the’ (17)
‘a’ (6)
’some’ (6)
any number, written in digits or in words (5)
‘it’ (2)

3. For each appearance in the document of the following words SUBTRACT the number of points indicated:
‘with’ (14)
possessives, ending in ’s’ (5)
possessive pronouns, such as ‘mine’, ‘yours’, ‘his’, ‘hers’, (3)
‘for’ (4)
‘not’ or any word ending with ‘n’t’ (4)

4. If the total score (after adding and subtracting as indicated) is greater than the total number of words in the document, then the author of the document is probably a male. Otherwise, the author is probably a female.



OS X Leopard upgrade for 10 bucks

16 10 2007

Apparently, Apple will sell you the v10.5 upgrade for $10 if you purchased your Mac computer after October 1, 2007.  I guess they [Apple] learned a thing or two from the sudden iPhone price drop recently.  Too bad I bought mine before that time.  Man!

Go here for details.