What is stopping the users from entering malicious ASP code in the reply boxes? like if they were to write %><%Response.Write("AHHHHH")%><% Why doesn't that "Actually" work?
Because, even if there were no checks to replace < and > with < and >, that code would not be executed on the server but written straight to screen as HTML.
Search is your friend “I was having a mildly paranoid day, mostly due to the fact that the mad priest lady from over the river had taken to nailing weasels to my front door again.”
Topic Locked
Posted - 12 January 2005 : 11:53:43
