[thelist] "email to a friend" link

[Madhu Menon]

At 12:49 AM 12-09-02, Chris Blessing wrote:
><A HREF="/sendToFriend.asp?link=<% = server.urlencode(theURL) %>">Send this
>page</A>
>
>On sendToFriend.asp, there's a simple form which posts back to
>sendToFriend.asp with the sender's name, email and comments, and the
>recipients name and email (and of course the URL to be sent, in a hidden
>field).

There is a big security risk in this approach. A clever person could trick
your script into sending the source code of your ASP pages by manipulating
the URL.

For instance, take a URL like:
http://www.example.com/sendtoFriend.asp?link=/article/tutorial1.asp
(I couldn't be bothered encoding the URL, sorry. ;)

By just changing the URL, you could get something like this:
http://www.example.com/sendtoFriend.asp?link=/cgi-bin/AddToCart.asp

which, in the absence of any other checks and controls, would happily send
the source code of the page, possibly containing database login and
password details.

Just something to keep in mind.

Regards,

Madhu


<<<   *   >>>
Madhu Menon
Internet User Experience Consultant

Content * Interfaces * Usability * Net Strategy