I think it is. Currently the folder is: inetpub/wwwroot/cardss Tim Featherston www.QBSix.com

You mean the add the cards directory to the production Server? https://CARDSS/cardss/default.aspx ?? I guess that would do it, eh? It just doesn't seem right! Now the dev tool dictates how you organize your web site? We even tried to pick up a variable from the web.config (appsetting section) where we would set a value either "/" or "/Cardss/" but some tags don't accept a variable for the path. TF Tim Featherston www.QBSix.com

Thanks Mike for the quick reply. I am probably not expressign myself correctly. My dev site is in a virtual directory named cardss. The production site is CARDSS. The site folder structure looks like this: Virtual Dir Web Site cardss/Images /Images cardss/Operations /Operations If a web page in the Operations folder: cardss/Operations/page.aspx has a reference to something in the images folder, /cardss/images/a.gif would be the path in the dev environment, /images/a.gif on the web site. The tilde does represent root directory on for code running on server side but it translates to ../ and we can't use ../ because of security issues. I assume everyone develops ASP.NET in virtual directories? When you move code to the production website, how do you deal with the fact that the virtual directory root (cardss) doesn't exist at the web site? TF Tim Featherston www.QBSix.com

Wouldn't you need to allow users in the XML folder, identify the user at Session_Start set a Session vairable that this user has permissions to view the contents of the XML folder, then modify every page in the XML folder to check the session variable and act accordingly? TF Tim Featherston www.QBSix.com

Glenn, you probably don't want to be writing it to Windows\System32 folder. WHatever folder you decide on right click and go to Properties|Security. If your ASPNET account isn't in the Group or User Name list box, click the Add button and then add the ASPNET account. Click the Allow check box for Write (and any other permissions you want). TF Tim Featherston www.QBSix.com

I am working on my first ASP.NET web application in a business environment and I am trying to figure out a better way to move code between the development site (a virtual directory) where the root directory is AName/.... to the web site where aName is the web site name. Right now if I have an image in a folder path /AName/images/something.gif is the path for the virtual directory site in developoment. When we move to our web site the path would be /images/something.gif. When I am getting ready to move th ecode, I do a global find an dreplace on /AName/ then build, move the dll's and apsx, etc files to a install folder, then do a global replace back on "/ changin git back to "/AName/. Pretty hokey, huh? There has got to be a better way. Thanks, TF Tim Featherston www.QBSix.com

IN IIS 6.0, there is a property "Allow "../" which by default is unchecked. I think in IIS 5.0, you accomplish this with a Microsoft tool called URLScan, which runs as an ISAPI filter. This web application will be running on the military secured network. You are correct. The ~ is rendered as a ../ on the browser if you view source. The following is an excerpt from Improving Web Application Security Patterns And Practices from Microsoft. Arbitrary Code Execution If an attacker can execute malicious code on your server, the attacker can either compromise server resources or mount further attacks against downstream systems. The risks posed by arbitrary code execution increase if the server process under which the attacker’s code runs is over-privileged. Common vulnerabilities include weak IID configuration and unpatched servers that allow path traversal and buffer overflow attacks, both of which can lead to arbitrary code execution. Countermeasures to help prevent arbitrary code execution include: ● Configure IIS to reject URLs with “../” to prevent path traversal. ● Lock down system commands and utilities with restricted ACLs. ● Stay current with patches and updates to ensure that newly discovered buffer overflows are speedily patched. Maybe ~ is OK because that is server side ? Like I said, I am pretty weak in this area. I appreciate your comments. TF Tim Featherston www.QBSix.com

No, the runat="server" doesn't work within the link tag. No error, jsut nothing happens. I'm confused, because the web hosting practice where I am taking this don't allow ../ logic. I have been reading web security papers this week, and it appears that is the direction sites are going to. If so, how do you reference /cardss.css from /aFolder/oneLevel/aPage.aspx ? All of my web experience has been in the middle (data services) and db tiers, so I am fighting the learnign curve for presentation development. Thanks for you comments. TF Tim Featherston www.QBSix.com

You don't have access to your SQL server, and there could be several reasons for that. Do you have Enterprise Manager? If so, it is a little friendlier. If you have Enterprise Manager, create a Windows Authentication login account for the ASPNET account (uUsually is "[MACHINE_NAME]\ASPNET", then make that login a user in the database you are using. You also don't need to use the ASPNET account. You can create your own SQL server Login, then in your ConnectionString use "server=[YOUR_SERVER];database=[YOUR_DATABASE];uid=[USER_ID];password=[YOUR_PASSWORD]" Tim Featherston www.QBSix.com

This code doesn't find the Style sheet: where the cardss.css is in the root of the web folder. I have used the ~ successfully in other areas such as <%@ Register...... Src="~/header.ascx" .....%> I am not allowed to use ../ to move up levels. I don't understand why the tilde is not working. I don't get an error, I just don't have any of the formatting. TF Tim Featherston www.QBSix.com

You're a Goddess! It is Control[0] BTW. Added this line of code: HyperLink hlcell = (HyperLink) cell.Controls[0]; switch(hlCell.Text) {.....} Thanks again. TF

I have a datagrid bound to a datatable containing 10 columns. 6 of the 10 columns are added to the table dynamically and contain the text "Gap", "Met", "Shortfall", "Not_Eval". These 6 columns are hyperlink columns, with the textField set to the appropriate column. I get back hyperlinked Gap, Met, etc.... SO I know that part is working fine. In the Page_Load event, after building the table and setting the grid data source, I execute this code. I am trying to set the cell back color to red, green, yellow or slate blue, depending on the Cell.Text value. Even though the Hyperlink text is displayed correctly, the cell.text is "". Here is the code. Color gap = Color.Red; Color shortFall = Color.Yellow; Color met = Color.Green; Color notEvaluated = Color.SlateBlue; Color duplicate = Color.Orange; foreach(DataGridItem item in Datagrid1.Items) { int taskId = int.Parse( item.Cells[0].Text); for(int i = 3;i < 10;i++) { TableCell cell = item.Cells[i]; switch(cell.Text) { case "Gap": cell.BackColor = gap; break; case "Met": cell.BackColor = met; break; case "Shortfall": cell.BackColor = shortFall; break; case "Not_Eval": cell.BackColor = notEvaluated; cell.ForeColor = notEvaluated; break; } } } I guess it is obvious that the hyperlink text is not the same property as the Cell.text, but I don't know what else to evaluate. I have looked, to no avail. Any help would be appreciated. TF