Question

i am a front-end coder, so i don’t know much about ASP
one of my clients called me for a simple help and i didn’t refuse him.

What he wants is a simple text box with a submit button, and when he submits a text, lets say “Sample”, he wants the server to call http://example.com/Sample.pdf after submission.

Simply, that is what i have at the moment:

<form action="form_action.asp">
<input type="text" name="pdf" value="enter pdf id" />
<input type="submit" value="Submit" />
</form>

It would be better if i can get a working answer as i don’t have asp server on my computer, i will not be able to test it.

Any help will be appreciated. Thanks.

Answer 1

This is a very bad idea, especially when the implementer doesn’t have an understanding of back-end coding. You are opening up the server to a whole heap of security issues.

If you allow anything to be put in this box, what would stop me entering ../includes/dbsettings.asp for example and getting access to files I really shouldn’t have access to?

How will you handle if the file doesn’t exist?

Actual Answer: This is a Q&A site, so here is the answer you requested, be careful what you do with it!

The following in it’s own ASP page should do what you want:

<%
Response.Redirect("/" & Request.Form("pdf") & ".pdf")
%>

You can (and should) get more complex by setting mime type, designating it as an attachment (so a download box is spawned), streaming the file and above all adding security and error checking.