Cookie to textbox?

[vbMark]

What am I doing wrong here?

<%
UserID = Request.Cookies("emu")("UserID")
%>

<TABLE>
<TR>
<TD>UserID: <INPUT id=UserID value="<%=UserID%>"></TD>
</TR>
</TABLE>

The textbox shows <%=UserID%> and not the value.

Any ideas?

Thanks!

 

[Manohar Kamath]

Code looks good to me, what is the value in the cookie?

 

[vbMark]

Code looks good to me, what is the value in the cookie?

Sorry, it was just showing wrong in InterDev's Quick View. It works fine
when viewed in the web browser.

Thanks.

 

[Manohar Kamath]

That's what I thought... Quick view is an HTML view of the page, and the
page is not "executed"

 

[Evertjan.]

Curt_C [MVP] wrote on 11 okt 2004 in
microsoft.public.inetserver.asp.general:

<TD>UserID: <INPUT id=UserID value="<%=UserID%>"></TD>

should be

<TD>UserID: <INPUT id=UserID value=<%=UserID%>></TD>

This is a bad advice as it will go wrong if UserID contains an inside space

 

[Dave Anderson]

What am I doing wrong here?

UserID = Request.Cookies("emu")("UserID")
...
<INPUT id=UserID value="<%=UserID%>">

Never mind QuickView, two other potential problems leap to mind:

1. Storing UserID as a cookie suggests a poor security model
unless this is just a device of convenience similar to the
way the Windows login prompt stores that Login ID of the
last person to log in

2. Unless you are in complete control of the range of possible
values for UserID, it might not hurt to display it like
this:

<INPUT id=UserID value="<%=Server.HTMLEncode(UserID)%>">


--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms. Please do not contact
me directly or ask me to contact you directly for assistance. If your
question is worth asking, it's worth posting.

 

[vbMark]

Never mind QuickView, two other potential problems leap to mind:

1. Storing UserID as a cookie suggests a poor security model
unless this is just a device of convenience similar to the
way the Windows login prompt stores that Login ID of the
last person to log in

This is just for our developers and testers.

2. Unless you are in complete control of the range of possible
values for UserID, it might not hurt to display it like
this:

<INPUT id=UserID value="<%=Server.HTMLEncode(UserID)%>">

Why, what does this do?

 

[Dave Anderson]

Why, what does this do?

It HTMLEncodes the value, which is how you protect your HTML from being
inadvertantly broken by characters like this:

" ><&
^^^^^

Generally not a big issue for UserIDs, I agree. But if you let your users
choose their own IDs, what happens when someone chooses [The "Dude"] ? Your
subsequent HTML:

<input id="UserID" value="The "Dude"">


Know thy data.


--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms. Please do not contact
me directly or ask me to contact you directly for assistance. If your
question is worth asking, it's worth posting.