Here’s a handy snippet to help you keep your VBscript forms secure. (If you’re ever using vbscript for any reason)
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
<% Session("last_nonce") = Session("current_nonce") sent = Request.Form("current_nonce") valid = Session("last_nonce") max=100000 min=1 Randomize Session("uwbkst_nonce") = "n"&(Int((max-min+1)*Rnd+min)) %> |
And then, somewhere in your form, include
|
1 |
<input type="text" name="uwbkst_nonce" value="<%=Session("uwbkst_nonce") %>"> |
And then in your form processor file
|
1 2 3 4 |
<!--#include file="nonce.asp"--> <% If sent = valid Then ' do something End If %> |