Thanks a lot f1fan for the thorough explanation~!
I must say that I learned a lot from that reply lol.
Now I know what sql injection means - thanks a lot.

Its part of my job - to find security holes in web sites and i think i can get into about 25% of so called "restricted access" websites within 30 seconds by SQL injections. Without knowing anything other than this post i would put money on the fact you are using the SA login, i would also put some good money on the fact that at least 25% of people reading this post are using the default SA password. I would also put money on the fact that 75% of "internal" applications (ie those that are within a lan/subnet for internal use only and not anywhere near the web) use windows logins for authentication and database access (then they wonder why their data is corrupted because all the users are linking access and excel spreadsheets to the data and changing it bypassing the integrity checks.
And just as some casual information... the most popular administrator password is.......... wait for it.... CONTROL

Interesting... Would you mind sharing what's the basic steps needed to secure your web ?

the very first and most important step is good programming. I cant stress it enough. Test for every eventuality. Too many people think error handling is a try catch block around everything. Secondly implement some login mechanism. Only allow people in the areas you specifically want them in so structure your site with subdirections. Validate every input at least 2x. Once on client side as best as you can (using the validator controls) and once on the server side (and if you can - in the database before a save). Use roles where needed. NEVER use querys in code ALWAYS use stored procedures. Disable the SA login in SQL Server and create a new one if you need to have a non windows one. Do not give windows accounts db permissions (except to DBAs and developers) always use application accounts. Encrypt passwords for connection strings and encrypt connection strings. Hash user passwords. Use strong passwords (a strong password for those who do not know is made up of upper and lower case letters, numbers and symbols). For those who say a strong password is too hard to remember try this. Make up two small words that are not associated (eg car knife) now substitute some symbols and numbers in there (@ or 4 for an A and ! or 1 for an I, and 3 for an E, $ or 5 for an S) and uppercase the first letter of each word. So your password is now C@rKn1f3 Thats a strong password, hard to break and easy to remember - just remember car knife and your substitutions. If you always use the same substitutions eg @ for A then it will be easy to remember and is very strong. If you let people make posts etc on your site then watch for cross site scripting. This is people putting javascript in links etc on your site. It recently happened on ebay where they put javascript in their listings to take people to a spoof login page and got their names and passwords. they managed to slip through ebays java detector (ebay lets you put some javascript on your listings). Use firewalls where you can. Only expose code on the website you need to, keep the rest behind the firewall. Use SSL where you can. Remember you wont keep everyone out. For those that do get in you want to be alerted that they are in and you want to know what they have changed or looked at when they are in.

Should say structure your site with subdirectories. i should pay attention when i type.

Nice. Thanks. I'm trying to re-read and digest :d

Hi,

I have a user control, with an ASP Wizard control inside it.
This control, generates the steps in the wizard dynamically, going throug a data object, and creating the steps and fields, adding the controls to each step, and a new step for a new group of controls.
This is done on the User control DataBind() method



Now.....
I am having a couple of different issues.
If in the Databind, I set ActiveWizardStep = 1, then the first time my page loads with the control, i see the wizard fine, but then when move to a nother step, i keep getting an error saying that ActiveStep = 2, must be lowerd than wizard stieps, etc.....

1) in what event of my user control, do i need to create the wizard steps? so that they maintain after postabcks? I would really like to only add the controls once on first page load, and then viewstate should be maintianed till the wizard is complete or submitted.

2) do you know of any sample code creating a wizard dynamically through code?
for example if in my app_code i wanted a method that did something like


any help or guidance would be appreciated. Thank you,
Jonathan

Hi,

I have been trying to dynamically add wizard steps to the wizard but, I have not been able to. Could you please tell me how you manage to add wizard steps to the wizard control. The code looks like this:

WizardStepBase wizardStepHelper = null;
wizardStepHelper = new WizardStep();
wizardStepHelper.Controls.Add(new TextBox());
wizardStepHelper.StepType = WizardStepType.Start;
Wizard1.WizardSteps.Add(wizardStepHelper);
for (int j = 1; j < 3; j++)
{

wizardStepHelper = new WizardStep();
wizardStepHelper.Controls.Add(new TextBox());
wizardStepHelper.StepType = WizardStepType.Step;
Wizard1.WizardSteps.Add(wizardStepHelper);

}

wizardStepHelper.Controls.Add(new TextBox());
wizardStepHelper.StepType = WizardStepType.Finish;
Wizard1.WizardSteps.Add(wizardStepHelper);

Could you please tell how you manage to dynamically add wizard steps to the Wizard...

Thanks!
I really appreciate it!!!

Ive tried both:
Step1.FindControl("txtName")
wizCreateBulk.FindControl("txtName")

But still get the Null exception error. Any Idea what i Am doing wrong?