John's Technology Blog

Classic ASP Master Pages

2010-03-27T12:00:00+10:00

When developing websites most of them have common elements like headers, footers and navigational menus that are common throughout the site. In Classic ASP we mostly use multiple server side includes to accomplish this. I like ASP.NET master pages and this page details the technique I use to achieve something similar in Classic ASP.

My technique involves creating a master page ASP file which has all the common elements. Where ever I want content to be added I add a call to a sub routine.

Then in my content pages when I want the master page content to be added I include it at that point. I then create a sub routine for each content area and put my content inside these. You can have as many content sub routines as required but they must exist in every content page that uses that master page.

The following example shows a master page and content page with two content areas: one inside the head tag (called HeadPlaceHolder in this example) so I can easily add title and meta tags, and add JavaScript and CSS within the head tag if required; and one inside the body tag between the header and footer (called ContentPlaceHolder in this example).

Any ASP variables that are needed by more than one content area should be created outside of the sub routines.

masperpage.asp

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<% Call HeadPlaceHolder() %>
<link rel="stylesheet" type="text/css" href="stylesheet.css" />
<script language="javascript" type="text/javascript" src="/java.js"></script>
</head>
<body>
<div id="header">
Logo etc etc
</div>
<div id="content">
<% Call ContentPlaceHolder() %>
</div>
<div id="footer">
Copyright etc etc
</div>
</body>
</html>

content-page.asp

<%
'Any ASP variables that are needed by multiple contenbt areas should be declared
'outside of the sub routines
'It's a good practice to keep your ASP script at the beginning of your pages anyway
%>

<% Sub HeadPlaceHolder() %>

<title>My page title</title>
<meta content="My meta description" name="description" />

<% End Sub %>

<% Sub ContentPlaceHolder() %>

<p>My page content goes here</p>

<% End Sub %>

eBay encourage/force you to lose money on postage

2009-12-10T12:00:00+10:00

eBay's postage calculator is a very useful tool for sellers but does not allow you to add any surcharge to cover handling or the fee that PayPal (an eBay company) will take out of the postage amount if a buyer chooses PayPal.

Not only that but eBay enforce sometimes unreasonable postage and handling charge limits on certain categories, for example a single book has a postage and handling charge limit less than the cost of postage to many areas of Australia. On top of tht they take their fee when payment is by PayPal so your loss is increased.

So you may need to up your item price to cover the money lost on postage charges, but of course then eBay take a larger commission from the sale.

CAPCTHAs and alternatives

2009-12-09T12:00:00+10:00

CAPTCHAs and their alternatives

The basic purpose of a CAPTCHA (Completely Automatic Public Turing Test to Tell Computers and Humans Apart) is to prevent robots from submitting web forms. By displaying an image that cannot be “read” by a computer, only a human can submit the form successfully.

Most of the time CAPTCHAs are an irritation to legitimate users, and can also cause issues with accessibility unless an alternative audible version of the text or numbers in the CAPTCHA image is also available.

My technique for CAPTCHA in Classic ASP is an image only system which works like this:

When the form is displayed two random numbers are generated. One is used as the number that is generated into an image. The other random number is used as the name of a session variable which contains the first number. This second number is stored as a hidden form field (it doesn't matter that this second number can be easily read). I use a random session variable name so as not to cause problems if the user has multiple forms open, this way each should submit without any conflict. On form submit the script gets the hidden field value and then the value of this session variable and compares this with the user's input. If they don't match the user (or robot) is redirected back to the form and two new random numbers are generated so the process repeats.

A more simple but less effective system that prevents some robots but avoids irritation to legitimate users and accessibility problems is to use a system similar to the CAPTCHA system described above where a random number is generated and added as a hidden form field and also stored in a session variable. On form post the hidden form field value is compared with the session variable value and succeeds only if they match. This means that the form can only be submitted if the user or robot visited the web form page first and posts the random number. This prevents robots that just simulate a form post to a URL from succeeding but doesn't stop the robot if they are willing to retrieve the web form page each time they post a form.

An improvement to this system would be to use a JavaScript script to add the value to the hidden field. Again, this would be fairly easy for a robot to simulate but would mean that the robot would have to be written specifically for the site.

Creating an image or audible CAPTCHA is not possible for some websites, for example in Classic ASP it usually requires a third party server component (although it can be done without one). There are other alternatives.

* Instead of creating a random number you could generate a random mathematical question, for example:

What is five plus twenty-three?

* You could create a database of random questions and answers, for example:

Which is not a colour? Blue, green, apple, orange or black?

* You could show several photos of different objects and ask the visitor to pick which picture contains a certain object.

All of these techniques are easy to produce using a system similar to what I described near the beginning of this article.

* You could create a textbox and set it to display:none in CSS. A robot is likely to fill this field so you can void any form submissions where this textbox is not empty.

* Dynamically change the names of form fields and store their new names in a session variable.

Obtaining Image Properties in ASP Without a Component

2009-12-09T12:00:00+10:00

You don't need a third party server component to determine the height and width of an image file in Classic ASP. The LoadPicture command will load an image into and object and you can then access the height and width, such as in this example:

Dim objImage
Set objImage = LoadPicture(Server.MapPath("image.ext")) 
intWidth = objImage.Width
intHeight = objImage.Height

4GuysFromRoll.com has an interesting article on resizing images without a component - see http://www.4guysfromrolla.com/webtech/050300-1.shtml.

The following link contains some other code that can access image properties as well as modify GIF images: http://www.u229.no/stuff/.

Lastly the following link is for a component-less CAPTCHA genertor which generates a BMP image from ASP.It may help you understand how to create and modify BMP files. See http://www.tipstricks.org/.

New Microsoft Hotmail good reason not to use Microsoft Explorer

2008-12-10T12:00:00+10:00

Am I the only one having problems with the newly updated Hotmail?

I use Hotmail regularly throughout the day on a variety of computers, Windows XP and Vista, Microsoft Internet Explorer 7 and 8 (Beta). After going through a few pages Explorer freezes up and has to be forcibly ended.

So now I prefer to use Firefox to check my Microsoft Hotmail.

Incidently I find that you cannot reply to an email using Hotmail on Google Chrome.

Why are most real estate agents so bad at selling online

2008-12-08T12:00:00+10:00

I have often read or heard that the Internet is now the most successful method of advertising for real estate agents.

So why is it that so many real estate agents fail to appreciate some basic fundamentals about advertising online.

Having been looking for a house for the last few months I have encountered three main issues that irritate me when it comes to real estate agents.

1. Poor listings

Now I admit that I don’t know how websites like realestate.com.au or domain.com.au charge agents but my guess is that there is probably no difference in cost between 1 photo and 5 or 10 photos, and there is probably a very generous limit on the amount of text they can enter for the property description.

So I don’t understand why so many agents have one photo and/or a very brief description of the property, often omitting information that might be important to potential buyers.

Agents should understand that certain information will affect whether their listing will appear when certain search criteria is selected. For example, I want to search for a house with a double garage but so many agents leave the carspaces that I can’t depend on this feature.

And why do so many use bad quality photos?

2. Response to enquiries

In this day and age it is not unreasonable to expect a reply to an email enquiry within several hours. At worst you would expect a business to check and respond to emails at least once a day.

But a large percentage of agents in my experience either do not respond to emails at all or take several days.

And when I ask a question I expect an answer in reply. So to the agent who replied to my request for the property’s address some two weeks later with, “Please telephone our office to speak to one of our sales consultants,” I say much too little, much too late.

3. Failure to update listings

Too many times I have enquired about properties only to find out that they have been long sold or are under contract.

I know the popular websites have the facility for agents to indicate that a property is sold or under offer or contract. I wish more agents would use them.

And it is good to see agents listing open for inspection times online (and I wish more would) but there should be no excuse for not removing these when the open house is cancelled.

Classic ASP Title Case

2008-07-29T12:00:00+10:00

Need a function that capitalises the first letter of each word, as used in titles?

Unlike some title case functions, this one doesn't just look for spaces, but capitilises the first letter after each non-alpha character which means that hyphenated words and words after numbers are considered new words.

Function TitleCase(byVal strValue) Dim intChat, intLastChar, blnUCase strValue = LCase(strValue) For intChar = 1 To Len(strValue) blnUCase = False If intChar = 1 Then blnUCase = True Else intLastChar = Asc(Mid(strValue, intChar - 1, 1)) If Not ((intLastChar >= 97 And intLastChar <= 122) Or (intLastChar >= 65 And intLastChar <= 90)) Then blnUCase = True End If End If If blnUCase Then strValue = Left(strValue, intChar - 1) & UCase(Mid(strValue, intChar, 1)) & Mid(strValue, intChar + 1) End If Next TitleCase = strValue End Function

Does stopfax.com.au really stop junk faxes?

2008-07-26T12:00:00+10:00

I received a "spam" fax some time ago on my home fax machine. I was pleased to see an opt-out website link at the bottom of the page which was www.stopfax.com.au/companyname. I didn't want any more faxes sent to my home fax so I went to the address and through the process to remove myself from this list.

However, over the following months I continued to receive "spam" faxes all from different companies but with a similar stopfax.com.au link to be removed from list.

I did follow the removal process with each fax but the faxes have not stopped.

I did a whois lookup of the stopfax.com.au domain name and found the owner to be:

CBOX PTY LTD
www.cbox.com.au

I have sent the following message through their contact us form on their website and will see what the response is.

Please remove my fax number from your database - 02xxxxxxxx. This is a home fax machine and I do not wish to receive any more faxes from any of your customers ever again. Thank you.

SQL Injection Protection - b.js

2008-06-30T12:00:00+10:00

There is a automated SQL injection attack doing the rounds at the moments which injects some html (<script src=http://www.domain.com/b.js></script>) into certain fields in all the tables in a database.

If you have been attacked don't feel bad as an Internet search of "b.js" reveals tens of thousands of hacked sites.

The attack cleverly appends a series of SQL commands onto your querystrings and if your code is unprotected, and you don't use Access databases, the commands may be passed on to your SQL server and the damage done.

Considering the damage that could be done by this sort of attack, I guess we are lucky that they chose only to append their little JavaScript.

However, this attack could render your website as "unsafe" in search engine results.

Reversing the Damage

We are also extremely fortunate that the changes can be easily reversed with a few changes of the attackers original SQL commands.

Simply execute the following to clean up the damage. If you have been attacked multiple times (ie. you have multiple script blocks appended to your SQL data) then you will need to execute the following script for each attack.

DECLARE @T varchar(255), @C varchar(255); DECLARE Table_Cursor CURSOR FOR SELECT a.name, b.name FROM sysobjects a, syscolumns b WHERE a.id = b.id AND a.xtype = 'u' AND (b.xtype = 99 OR b.xtype = 35 OR b.xtype = 231 OR b.xtype = 167); OPEN Table_Cursor; FETCH NEXT FROM Table_Cursor INTO @T, @C; WHILE (@@FETCH_STATUS = 0) BEGIN EXEC( 'update ['+@T+'] set ['+@C+'] = left( convert(varchar(8000), ['+@C+']), len(convert(varchar(8000), ['+@C+'])) - 6 - patindex(''%tpircs<%'', reverse(convert(varchar(8000), ['+@C+']))) ) where ['+@C+'] like ''%<script%</script>''' ); FETCH NEXT FROM Table_Cursor INTO @T, @C; END; CLOSE Table_Cursor; DEALLOCATE Table_Cursor;

Protecting against attacks

There are many methods out there to protect against this sort of attack.

The best method is to ensure that you protect every value that you pass to SQL. Strings should have a function to replace single quotes with two single quotes. Numbers should have a function that forces them to a numeric value.

The following function is a simple method which removes multiple inline SQL commands. If you issue multiple inline SQL commands in one go then obviously it will not be suitable but for everyone else it should stop any attack. This will not protect against all types of attacks however.

Parse your SQL command strings with the following syntax:

SQLCheck(sql-string-here)

Function SQLCheck(strCommand) Dim intChar Dim blnQuotes SQLCheck = strCommand blnQuotes = False For intChar = 1 To Len(strCommand) If Mid(strCommand, intChar, 1) = "'" Then If Not blnQuotes Then blnQuotes = True Else If intChar < Len(strCommand) Then If Mid(strCommand, intChar + 1, 1) = "'" Then intChar = intChar + 1 Else blnQuotes = False End If End If End If ElseIf Mid(strCommand, intChar, 1) = ";" Then If Not blnQuotes Then SQLCheck = Left(strCommand, intChar - 1) Exit For End If End If Next End Function

Unfair eBay fees for used cars

2008-06-10T12:00:00+10:00

Having just been through the process of selling a cheap used car on eBay I have seen first hand the unfairness of eBay's fees for this category.

By a cheap car I mean $250.

eBay's fees are $5 for the listing and a fixed commission of $40 upon successful sale.

For a $250 car that means the fees total nearly 20%.

Selling a $50,000 car? Your fees would be just a fraction of 1%.

I realise that eBay have to be price competitive with other online car advertising sites but surely for cheap cars they could have a lower commission based on the sale price.

Now I see why I often see cheap used cars advertised outside of the used car category.

100% CSS Layout

2008-05-28T12:00:00+10:00

I had been looking for a CSS layout that has three components - a header, footer and content area - and the following characteristics:

When the content in the content area does not fill the available window space the footer should be set to the bottom of the page.
When the content overflows the footer should be positioned at the end of the document, off the screen.
The content area should fill at least all remaining window space so that any object I put inside it can scale to 100% of its height.
The content area should have a minimum height so that it won't look silly in a very tiny window (unlikely)
If the user resizes the browser the content area should resize.

I couldn't find a pure CSS solution so I came up with a solution that uses CSS and JavaScript.

View Sample (new window)

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head> <title>Untitled Page</title> <script type="text/javascript"> function maxContent(){ var divContent = getElementDimensions(document.getElementById("content")); var divHeader = getElementDimensions(document.getElementById("header")); var divFooter = getElementDimensions(document.getElementById("footer")); var remainder = document.documentElement.clientHeight - divContent.y - divFooter.height - 0 if(remainder<250){remainder=250}; //minimum height of content document.getElementById("content").style.height = remainder + "px"; function getElementDimensions(q){ var offsetY=offsetX=0; var height=q.scrollHeight; var width=q.scrollWidth; while(q){ offsetX+=q.offsetLeft; offsetY+=q.offsetTop; q=q.offsetParent; } return{ "x":offsetX,"y":offsetY,"height":height,"width":width }; } } window.onload = maxContent; window.onresize = maxContent; </script> <style type="text/css"> html,body { margin:0; padding:0; } div#container { } div#header { background-color:#fbb; } div#content { background-color:#bfb; } div#footer { background-color:#bbf; width:100%; bottom:0; } </style> </head> <body> <div id="container"> <div id="header"> Header </div> <div id="content"> <table border="1" height="100%"> <tr> <td>1</td> <td>2</td> <td>3</td> </tr> <tr> <td>b1</td> <td>b2</td> <td>b3</td> </tr> </table> </div> <div id="footer"> Footer </div> </div> </body> </html>

MySql: Data Types

2008-05-03T12:00:00+10:00

Type {storage}	Name	Range	Attributes	Default
Numeric {1 byte}	TINYINT[(M)]	-128 TO 127 [0 to 255 if UNSIGNED]	AUTO_INCREMENT UNSIGNED, ZEROFILL, SERIAL DEFAULT VALUE	NULL [0 if NOT NULL]
Numeric {2 bytes}	SMALLINT[(M)]	-32,768 to 32,767 [0 to 65,535]	AUTO_INCREMENT, UNSIGNED, ZEROFILL, SERIAL DEFAULT VALUE	NULL [0 if NOT NULL]
Numeric {3 bytes}	MEDIUMINT[(M)]	-8,388,608 to 8,388,607 [0 to 16,777,215]	AUTO_INCREMENT, UNSIGNED, ZEROFILL, SERIAL DEFAULT VALUE	NULL [0 if NOT NULL]
Numeric {4 bytes}	INT[(M)]	-/+2.147E+9 [0 to 4.294E+9]	AUTO_INCREMENT, UNSIGNED, ZEROFILL, SERIAL DEFAULT VALUE	NULL [0 if NOT NULL]
Numeric {8 bytes}	BIGINT[(M)]	-/+9.223E+18 [0 to 18.45E+18]	AUTO_INCREMENT, UNSIGNED, ZEROFILL, SERIAL DEFAULT VALUE	NULL [0 if NOT NULL]
Numeric {4 or 8}	FLOAT(p)	p=0-24 --> "FLOAT" p=25-53 --> "DOUBLE"	UNSIGNED, ZEROFILL	NULL [0 if NOT NULL]
Numeric {4 bytes}	FLOAT[(M,D)]	Min=+/-1.175E-38 Max=+/-3.403E+38	UNSIGNED, ZEROFILL	NULL [0 if NOT NULL]
Numeric {8 bytes}	DOUBLE[(M,D)]	Min=+/-2.225E-308 Max=+/-1.798E+308	UNSIGNED, ZEROFILL	NULL [0 if NOT NULL]
Numeric {M+2}	DECIMAL[(M,[D])] Stored as string	Max Range = DOUBLE range Fixed point vs. DOUBLE float	UNSIGNED, ZEROFILL	NULL [0 if NOT NULL]
Bit {8 bytes}	BIT[(M)]	Binary. Display by [add zero \| converting with BIN()]. M=1-64	Prior to 5.03 TINYINT(1) Synonym	NULL [0 if NOT NULL]
String {M char's}	CHAR[(M)]	M=0-255 Characters, FIXED. Right padded with spaces.	BINARY, CHARACTER SET	NULL ["" if NOT NULL]
String {M char's¹}	VARCHAR(M)	M=0-65,535 Characters M=0-255 <v5.0.3	BINARY, CHARACTER SET	NULL ["" if NOT NULL]
String {#char's¹}	TINYTEXT²	0-255 Characters	BINARY, CHARACTER SET	NULL ["" if NOT NULL]
String {#char's¹}	TEXT²	0-65,535 Char's	BINARY, CHARACTER SET	NULL ["" if NOT NULL]
String {#char's¹}	MEDIUMTEXT²	0-16,777,215 Char's	BINARY, CHARACTER SET	NULL ["" if NOT NULL]
String {#char's¹}	LONGTEXT²	0-4,294,967,295 Char's	BINARY, CHARACTER SET	NULL ["" if NOT NULL]
String {M bytes}	BINARY[(M)]	M=0-255 bytes, FIXED.	Global Only (case sensitive)	NULL ["" if NOT NULL]
String {M bytes}	VARBINARY(M)	0-65,535 bytes M=0-255 <v5.0.3	Global Only (case sensitive)	NULL ["" if NOT NULL]
String {#bytes¹}	TINYBLOB	0-255 bytes	Global Only (case sensitive)	NULL ["" if NOT NULL]
String {#bytes¹}	BLOB	0-65,535 bytes	Global Only (case sensitive)	NULL ["" if NOT NULL]
String {#bytes¹}	MEDIUMBLOB	0-16,777,215 bytes	Global Only (case sensitive)	NULL ["" if NOT NULL]
String {#bytes¹}	LONGBLOB	0-4,294,967,295 bytes	Global Only (case sensitive)	NULL ["" if NOT NULL]
String {1-2 bytes}	ENUM² ("A1","A2",...)	Column is exactly 1 of 1-65,535 values	CHARACTER SET	NULL [1st value if NOT NULL]
String {1-8 bytes}	SET² ("A1","A2",...)	Column is 0 or more values in list of 1-64 members	CHARACTER SET	NULL ["" if NOT NULL]
Date & Time {3 bytes}	DATE	"1000-01-01" - "9999-12-31"	Global Only (YYYY-MM-DD)	NULL ["0000-00-00" if NOT NULL]
Date & Time {8 bytes}	DATETIME	"1000-01-01 00:00:00" - "9999-12-31 23:59:59"	Global Only (YYYY-MM-DD hh:mm:ss)	NULL ["0000-00-00 00:00:00" if NOT NULL]
Date & Time {3 bytes}	TIME	"-838:59:59" - "838:59:59"	Global Only (hh:mm:ss)	NULL ["00:00:00" if NOT NULL]
Date & Time {4 bytes}	TIMESTAMP	19700101000000 - 2037+	Global Only (YYYYMMDDhhmmss)	Current Date & Time
Date & Time {1 bytes}	YEAR	1900 - 2155	Global Only (YYYY)	NULL ["0000" if NOT NULL]

MS-SQL: Data Types

2008-05-03T12:00:00+10:00

Data Types	Description
bigint	Integer data from -2^63 through 2^63-1
int	Integer data from -2^31 through 2^31 - 1
smallint	Integer data from -2^15 through 2^15 - 1
tinyint	Integer data from 0 through 255
bit	Integer data with either a 1 or 0 value
decimal	Fixed precision and scale numeric data from -10^38 +1 through 10^38 -1
numeric	Fixed precision and scale numeric data from -10^38 +1 through 10^38 -1
money	Monetary data values from -2^63 through 2^63 - 1
smallmoney	Monetary data values from -214,748.3648 through +214,748.3647
float	Floating precision number data from -1.79E + 308 through 1.79E + 308
real	Floating precision number data from -3.40E + 38 through 3.40E + 38
datetime	Date and time data from January 1, 1753, through December 31, 9999, with an accuracy of 3.33 milliseconds
smalldatetime	Date and time data from January 1, 1900, through June 6, 2079, with an accuracy of one minute
char	Fixed-length character data with a maximum length of 8,000 characters
varchar	Variable-length data with a maximum of 8,000 characters
text	Variable-length data with a maximum length of 2^31 - 1 characters
nchar	Fixed-length Unicode data with a maximum length of 4,000 characters
nvarchar	Variable-length Unicode data with a maximum length of 4,000 characters
ntext	Variable-length Unicode data with a maximum length of 2^30 - 1 characters
binary	Fixed-length binary data with a maximum length of 8,000 bytes
varbinary	Variable-length binary data with a maximum length of 8,000 bytes
image	Variable-length binary data with a maximum length of 2^31 - 1 bytes
cursor	A reference to a cursor
sql_variant	A data type that stores values of various data types, except text, ntext, timestamp, and sql_variant
table	A special data type used to store a result set for later processing
timestamp	A database-wide unique number that gets updated every time a row gets updated
uniqueidentifier	A globally unique identifier

VBScript: Suggested Prefixes for Indicating the Data Type of a Variable

2008-05-03T12:00:00+10:00

Data Type	Prefix
ADO command	cmd
ADO connection	cnn
ADO field	fld
ADO parameter	prm
ADO recordset	rst
Boolean	bln
Byte	byt
Collection object	col
Currency	cur
Date-time	dtm
Double	dbl
Error	err
Integer	int
Long	lng
Object	obj
Single	sng
String	str
User-defined type	udt
Variant	vnt

Handling Boolean Fields in MS-SQL and MS-Access

2008-05-03T12:00:00+10:00

If you have migrated from Microsoft Access to SQL Server or MySql then you have probably encountered the differences with boolean values.

In Microsoft Access you can use true or false in queries, for example:

SELECT * FROM tablename WHERE booleanfield=TRUE
SELECT * FROM tablename WHERE booleanfield=FALSE

SQL Server/MySql require a different approach:

SELECT * FROM tablename WHERE booleanfield=1
SELECT * FROM tablename WHERE booleanfield=0

The Microsoft Access query will not work in SQL Server/MySql and the SQL Server/MySql query will not work in Access as it treats true as -1 not 1.

For a cross-platform solution you can use the following:

SELECT * FROM tablename WHERE booleanfield<>0
SELECT * FROM tablename WHERE booleanfield=0