I’ll detail the hack in a later post.

Dim s As String

If String.IsNullOrEmpty(s) Then
  Console.WriteLine(“String is null or empty.”)
Else
  Console.WriteLine(String.Format(“String = {0}”, s))
EndIf

This isn’t exactly an earth shattering discovery, but it’s useful nonetheless.

First here’s a link to a post on Glen Gordon’s blog about injection: http://blogs.msdn.com/glengordon/archive/2008/04/15/some-sql-injection-attack-misperceptions-and-reality.aspx. Glen includes a nice list of common mistakes when thinking about preventing injection attacks.

Next is a link from the MSDN magazine showing how to stop injection attacks: http://msdn2.microsoft.com/en-us/magazine/cc163917.aspx
I know this was a lazy post, but cut me some slack. I’ve got a 2 month old baby and a new PS3.

• Databases
• Form fields
• Session variables
• Query string
• Cookies

Using the library is very simple. Just add a reference to the dll to your project, and you’re ready to go. Here’s a quick and dirty code example encoding a value from the query string:

string Name = AntiXss.HtmlEncode(Request.QueryString["Name"]);

A good rule to live by is “When in doubt. Encode it.” Just don’t encode it twice.

You can download the library from Microsoft here.

We work on strictly enterprise applications and as a result we’re tucked in behind a nice corporate firewall. This is no comfort though because we have sites all over the world, and there are countless opportunities for attackers to get behind enemy lines. Because I’m beginning to take a more in-depth approach to security and how I write code, I thought I would share some of my lessons here in yet another series of blog posts (like the Second Look at Linux and FLOSS series weren’t enough). My next installment will concentrate on using the Anti-Xss library as well as a few code samples. The library is free to use and provides an easy method for encoding output from untrusted sources (i.e. the user).