[thelist] .asp include page not previewing

Ken Schaefer Ken at adOpenStatic.com
Thu Jan 20 16:19:27 CST 2005



: -----Original Message-----
: From: thelist-bounces at lists.evolt.org
[mailto:thelist-bounces at lists.evolt.org] On
: Behalf Of Chris.Marsh at Callserve.com
: Sent: Friday, 21 January 2005 7:39 AM
: To: thelist at lists.evolt.org
: Subject: RE: [thelist] .asp include page not previewing
: 
: > >> Active Server Pages, ASP 0126 (0x80004005)
: > >> The include file '../SSI/footer.asp' was not found.
: > >> /new site testing/Parents/Testing.asp, line 123
: > >>
: > >> anyone see what I might be doing wrong?
: >
: > >AFAIK, "virtual" is from the website root. Hence, you should use the
: > >path: "SSI/footer.asp".
: >
: > And if that doesn't work, you know, you could just ahhh make
: > sure the file
: > is there... maybe ;-)
: 
: It doesn't matter whether the file is there or not. Unless you have
: explicitly allowed upward directory traversal in file paths for server side
: includes, the file won't be found.
: 
: As an aside, the MSDN library page I posted the link for specified that it
: is recommended to use the "inc" suffix for server-side include files. I
: would disagree with this from a security perspective. 

The page you linked to explicitly tells you to use the .asp extension, or
similar, when there is sensitive data in the #include file.

The recommendation is to use the .inc extension when you are including
non-sensitive data (e.g. common client-side navigation items).

Cheers
Ken


More information about the thelist mailing list