SMT Internet Promotion Blog

Copywriters can take the pain out of content creation

5/13/2009 6:56:00 PM

If writing is not your thing then we recommend hiring a copywriter to help you with the creation of your web site content. There are many great copywriters out there that can (with minimal input from you) turn those blank white pages into interesting and engaging content for your web site. You will still need to read it over and make some corrections, however, it is much easier to tweak than to come up with all the ideas yourself.

Protect your website from SQL Injection Attacks

4/22/2009 12:03:00 PM

Is your website vulnerable? Very possible. You could do a few quick checks, but explaining how to write SQL Injection code is out of the scope of this blog. Websites written using Classic ASP language, PHP, AJAX, and other website languages are vulnerable, but that doesn't leave .NET websites in the clear. Any website that gives full access to the SQL database is vulnerable. That gives the hacker full range at manipulating the information in your database. So, what are some ways to protect against SQL Injection? Below are some recommendations on how to protect your database from SQL Injection Attacks. They should all be done, but some can be done independently or not at all. One way is to take an inventory of all dynamically driven pages. If it uses or talks to a database, it could be vulnerable. More investigation in the programming would identify if it is the extent of it vulnerability. There are some inexpensive automated tools out there that will identify the holes you may have in your website. For example Acunetix Web Vulnerability Scanner has a free version. Validate all data that gets passed to the database. For example, if the web page expects an integer data type, check to make sure a hacker is not trying to pass in a line of hacking code and only accept an integer value. Eliminate any inline SQL that is used on these pages and change them to parameter based stored procedures. When you use a stored procedure to talk to the database and use parameter objects, the data that gets passed to the database must be the right type. Stored procedures by themselves are not the answer alone. Limit the website login to the database to only run the stored procedures needed for the website. DO NOT give the website "dbo" access to the database. One way for hackers to grab the sensitive information is by viewing any errors from the website that their hacking attempts display. It is a way to grab sensitive data, like credit card number. Use a server 500 redirect page to redirect and SQL errors returned so they are not shown to the hacker. A recent widespread attack across the glob used access to the sys objects in the database to break in. So, deny access to the sys objects in the database to the web user. Never store sensitive information in clear-text within a database. Encrypt your sensitive passwords, credit card data, social security numbers, and other private information. There are more advanced articles that explain these techniques and explain some of the terms used above in more detail. But I wanted to keep this article simple and to the point. You can read more at ScottGu's Blog Tip/Trick: Guard Against SQL Injection Attacks

Parsing data in C#

4/22/2009 11:02:00 AM

Parsing data in C# is a simple process, and can be done using some basic language syntax. Sub Strings provide this functionality, and when used properly can make data collection, or simple parsing operations a much easier task. First when parsing data from sources such as a web page, it is important to first remove all data at the beginning of the document which is unnecessary, in order to prevent the parsing utility from finding the wrong information. website design search results http://randomexamplesiteurl.com/ en Wed, 15 Apr 2009 18:31:33 GMT Wed, 15 Apr 2009 18:31:33 GMT website design - sample feed http://randomexamplesiteurl.com/testimage1.gif http://randomexamplesiteurl.com/ Small Businesses Receive Web Design Financing from Wildfire http://randomexamplesiteurl.com/testlink1.html Wed, 15 Apr 2009 07:15:30 GMT This is a sample description I am using for testing purposes Effective website design for successful ecommerce http://randomexamplesiteurl.com/testlink2.html Wed, 15 Apr 2009 11:23:38 GMT This is a sample description I am using for testing purposes website design - XML Sample Finding unique tags to mark the beginning of the data to be parsed is the key to building an efficient parsing utility. In the above sample, all of the text prior to "" is irrelevant if you are only attempting to gather the item data, and will not be needed to complete the parsing process. To remove this from your text use the following code: (code assumes data is loaded in a string variable named strData) int intStartPos = strData.IndexOf(""); strWorkingRSS = strData.Substring(intStartPos); Once the irrelevant data has been removed, you can then focus on parsing the remainder of the string, with the following code this can be done by using any unique string at the beginning and the end of the data you would like to capture. The following code will always stop at the first instance of search string so if you continue to trim the text as you work using the above sample, you can easily write a loop to pull out each of the items until the data has all been parsed successfully. The below sample will result in assigning the variable strTitle with the text in between the "" and "" tags. string strOpenString = ""; intStartPos = strData.IndexOf(strOpenString ) + strOpenString .Length; int intEndPos = strData.IndexOf(""); int intLength = intEndPos - intStartPos; string strTitle = strData.Substring(intStartPos, intLength); This should be enough information to get any parsing project started. The data that I used for my sample may have been XML, but the real value in this type of parsing utility, is in cases where data from an HTML site, or group of HTML pages needs to be moved to a dynamic location such as a database. Many times the only viable option for data transfer is to use a "screen scraping" application, and this code provides a general outline for how to build one for most any circumstances.