I am creating a Java web service that is receiving input requests in XML format. The web service's function is to parse the XML initial request and send it's own post request to a third party organization which does a look-up for the request and if available they send a response back in XML format to the web service for processing. If the response does find the data in the look-up the information it sends back as XML and is parsed by the web service then saved as a .pdf file. Once the .pdf file is created the web service packages a response XML message and along with the identifying information a link to the .pdf is part of the message sent back to the calling client. Now, if the search for the information is not found a XML message is sent back to the client indication the third party did not have the information ready with a status as pending. For all of the requests for the third party information the web service will create a folder on the server with a XML status file and if the .pdf file is created it will be in this folder too. Now comes the tricky part of the design. There is another application located on the same server that needs to be running in a loop that and every 30 second it needs to call the web service on it's own and if the server folder created by each new request does not contain the .pdf that program will make the web service call to retry the initial call and see if third party does now responds with the XML message that contains the valid information so it can create the .pdf and send a message back to the original client. Now, if I am using a tomcat server what type of application should I create that does the 30 second looping? The server does have a MySQL database. How should I have the 30 second looping application communicate with the web service? Finally, if the looping application does make a successful call to the web service what is the best way to cause a trigger from the looping application to make the web service send the successful response to the original calling client? Finally, if the looping application does make a successful call to the web service what is the best way to cause a trigger from the looping application to make the web service send the successful response to the original calling client? One note is that the 30 second loop must scan the new request folder tree and retry for any of the requests that have not succeeded.

I have read the following article: https://msdn.microsoft.com/en-us/library/bb355989.aspx Now this article allows me to understand XSS vulnerability defense to a webpage that is statically made up of asp and html controls built on a webpage as in true markup layout fashion. I now understand that that control input should use not only server side in validation but input should validate length, range, format and type. The question I have is that I am trying to sanitize a website where the page layout controls are build on to the DOM object dynamically when the page loads. For example on the page load event methods add controls to the document object one at a time in the method that builds the entire webpage during that calling method. Also, control event handling is done by methods that send concatenated JavaScript strings, during page load, as output to the page that handle page control events. I guess my question is, how do I use asp.net validation controls, regex checking, etc. functionally when everything is built, the DOM and JavaScript event handling on the loading of the webpage? For example adding controls as in the following fashion:

    private void CreateControls(ControlCollection cc)
    {
        if (RadScriptManager.GetCurrent(\_contextPage) == null)
        {
            RadScriptManager rsm = new RadScriptManager();
            rsm.ID = "scriptManager";
            cc.Add(rsm);
        }

}

I am new to repairing security vulnerability on ASP .NET code. Can someone give me links to on-line reference material where someone new like me can learn the process?

Lefevre, You make a good point about me being confused. I really can't show you anything that doesn't require a loop. I have three other findings that are simple hard coded commands with parameters as part of the string. This is what I showed you in my first post that you answered before this one. In every case a loop is required to add the sql parameters to the command. I have been looking for some kind of Lambda expression to add the values to the sql command parameter list which I can not find.

No. I still have to use the static command but eliminate the hard coded parameters. That being the case I want to use the technique above for passing in the parameters, use the loop, which is the problem to begin with, to fill in a parameterized string like so: command.CommandText = ("INSERT INTO TABLE (result, title, des) values(@store_result, @store_title, @store_des)");

OK. Let me explain. I have found some code that I think will work but how would I know what sql command it would be. See code below: SqlCommand cmd = new SqlCommand(commandText, connection); SqlParameterCollection sp = cmd.Parameters; List sp = new List() { new SqlParameter() {ParameterName = "@CmpyCode", SqlDbType = SqlDbType.NVarChar, Value= CV.Global.CMPYCODE}, new SqlParameter() {ParameterName = "@Code", SqlDbType = SqlDbType.NVarChar, Value = codeName}, new SqlParameter() {ParameterName = "@DisplayCode", SqlDbType = SqlDbType.NVarChar, Value = codeName + "-"}, new SqlParameter() {ParameterName = "@TotalDigit", SqlDbType = SqlDbType.Int, Value = CV.Global.PARAMTOTALDIGIT} }; insertData(CV.Sps.SP_INSERT_PARAM_TABLE, sp); SqlCommand cmd = new SqlCommand(); cmd.Parameters.AddRange(parameterPasses.ToArray());

I saw a very good answer to my question about parameterizing a string with the actual parameters; how would I know whether the command was an UPDATE, INSERT, or a DELETE? SqlCommand cmd = new SqlCommand(commandText, connection); SqlParameterCollection sp = cmd.Parameters; List sp = new List() { new SqlParameter() {ParameterName = "@CmpyCode", SqlDbType = SqlDbType.NVarChar, Value= CV.Global.CMPYCODE}, new SqlParameter() {ParameterName = "@Code", SqlDbType = SqlDbType.NVarChar, Value = codeName}, new SqlParameter() {ParameterName = "@DisplayCode", SqlDbType = SqlDbType.NVarChar, Value = codeName + "-"}, new SqlParameter() {ParameterName = "@TotalDigit", SqlDbType = SqlDbType.Int, Value = CV.Global.PARAMTOTALDIGIT} }; insertData(CV.Sps.SP_INSERT_PARAM_TABLE, sp); SqlCommand cmd = new SqlCommand(); cmd.Parameters.AddRange(parameterPasses.ToArray());

I have two classic asp pages on my local machine that I would like to test them by bring each up in a browser from Visual Studio just to test a few links. How can I do this?

I am changing some markup and need to make another classic asp page as the start up page from with in IIS. How do I change the classic asp start page from IIS directly?

I have a MS classic ASP set of test files. From a MS article, please see link be below. The article doesn't show how to deploy this test app. Can any one explain how to deploy? http://support.microsoft.com/kb/169377

I have a situation where a classic ASP's MS SQL database has been moved from a server 2003 to a 2008r2. The classic asp application stills resides on a server 2003. Now because I have never done a migrating the only thing I thought I needed to change is the SQL server named IP address in the application's IIS deployed ini file. Currently am using anonymous authentication and the default application pool. The application render's to the browser fine. The problem is the application is not pulling any data for the database. It seems that I have missed something in the configuration process. Has some done this type of migration and if so provide me a list of thing that they have done to configure the application correct and other settings for the migration? Thanks, Steve Holdorf

Hi, I have very little experience with SharePoint. I have searched the web and this site but am unable to find a post or article that doesn't seem very confusing and after trying allows me to get an asp.net application to run on the same host as my SharePoint server. I know SharePoint uses port 80 and have tried other ports for my asp.net application. I have also tried one article's suggestion of modifying the asp.net application's web.config but still no success. Can someone direct me to an article or instruct me on how this is done?

I have a RadGrid using a standard grid hierarchy and am trying to open a RadWindow from within the OnItemCommand event when a radbutton column item is selected. When I select the button the code below does run (checked using a break point); however, the radwindow does not open and the radgrid itself appears to do a partial postback. Any Ideas why the rad window does not display? The code is as follows: protected void RadGrid1_ItemCommand(object sender, GridCommandEventArgs e) { if (e.CommandName == "ButtonEdit") { //opening window RadWindow newWindow = new RadWindow(); newWindow.ID = "RadWindow1"; newWindow.NavigateUrl = "Window1.aspx"; newWindow.VisibleOnPageLoad = true; RadWindowManager1.Windows.Add(newWindow); } } Also note, the RadWindowManager is valid as it is used elsewhere on the page with no problems. Thanks, Steve Holdorf

Manfred, Sorry about the repeated posts. It won't happen again. Thanks, Steve Holdorf :((

I am using the XMLHttpRequest object to do a xmlhttp.open in a javascript function; however, when I make the open call the asp page's onload event never gets fired. See example below: function myfunct () { var xmlhttp = new XMLHttpRequest(); xmlhttp.open("GET", "myPage.aspx?Action=Save", true); } What I was trying to do was call a asp code behind method from javascript. I tried PageMethods but it only calls static methods. Then I attempted to go with the XMLHttpRequest object and use the asp code behind on load event to get the query string and process based on it's value. Now, I don't want a postback so I set the async parameter to true but now it still does not work. What is the best way to access non static code from javascript? Thanks, Steve Holdorf

OK. I found a way to call the page method from the usercontrol. Now, the problem is PageMethods.SaveData() is only used for static methods. How do I call a non-static page method from my javascript? Thanks, Steve Holdorf

One thought. I could move the method to the parent page if someone knows how to call a method in the containing page from one of its usercontrols using javascript without a postback. I hope this is also possible. Anyway, with all of the posts everyone has been great! I just got to get it working. Thanks, Steve Holdorf

You are correct. XMLHttpRequest does work for AJAX as well; however, not for what I am doing. Really, all I need to do is to get the usercontrol object (the container control) in my javascript and call the SaveData code behind method (of the container control) without a postback. Thanks for everyones help; however, I am still stuck. Steve Holdorf

Your link is great but it still uses jquery. Does anyone have a link just using AJAX and javascript? Thanks, Steve Holdorf

Again thanks for sharing your knowledge!!!! I am still a little lost. Can anyone post a small demo or a link to one? Again thanks!!! Steve Holdorf