File System Object and displaying data

[Rahul Chatterjee]

Hello All

I used to have some static htm files which used to display data. There is a
calling asp file which used to do something like below

if Request.QueryString("PageName").count = 0 then
strPageNameHtm = "toc.htm"
strPageNameInc = "toc.inc"
else
strPageNameHtm = Request.QueryString("PageName") & ".htm"
strPageNameInc = Request.QueryString("PageName") & ".inc"
end if
strPageNameHtm = server.mapPath(strPageNameHtm)

strPageNameInc = server.mapPath(strPageNameInc)
'response.write(strPageNameHtm)
set fs = server.createobject("scripting.fileSystemObject")
set f = fs.openTextFile(strPageNameHtm)
strSPDHtml = f.readall


The strSPDHTML info used to be displayed using a response.write(strSPDHTML).
This allowed the static content to be loaded up.

I switched the static pages to be asp pages having the content come from a
database. I would still like to maintain the controlling page logic. Can I
modify the above section of code in anyways to access the asp page content

 

[Anthony Jones]

Hello All

I used to have some static htm files which used to display data. There is a
calling asp file which used to do something like below

if Request.QueryString("PageName").count = 0 then
strPageNameHtm = "toc.htm"
strPageNameInc = "toc.inc"
else
strPageNameHtm = Request.QueryString("PageName") & ".htm"
strPageNameInc = Request.QueryString("PageName") & ".inc"
end if
strPageNameHtm = server.mapPath(strPageNameHtm)

strPageNameInc = server.mapPath(strPageNameInc)
'response.write(strPageNameHtm)
set fs = server.createobject("scripting.fileSystemObject")
set f = fs.openTextFile(strPageNameHtm)
strSPDHtml = f.readall


The strSPDHTML info used to be displayed using a response.write(strSPDHTML).
This allowed the static content to be loaded up.

I switched the static pages to be asp pages having the content come from a
database. I would still like to maintain the controlling page logic. Can I
modify the above section of code in anyways to access the asp page content

Sounds like you are looking for this:-

if Request.QueryString("PageName").count = 0 then
strPageName = "toc.asp"
else
strPageName = Request.QueryString("PageName") & ".asp"
end if
Server.Execute strPageName
end if

You should be aware however that this can allow a client to bypass some
forms of security. E.g a sub folder of ASPs may have anonymous user turned
off or IP range restrictions but the above page could allow an external user
to execute these pages.