Home/ Questions/Q 5842887
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-22T12:04:39+00:00

I have a page in VB ASP.NET with the following code (this was generated

  • 0

I have a page in VB ASP.NET with the following code (this was generated by VS):

<%@ Page Language="VB" AutoEventWireup="false" CodeFile="Payment2.aspx.vb" Inherits="Payment2" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
   <title></title>
</head>
<body>
   <form id="form1" runat="server">
     <div>

     </div>
   </form>
</body>
</html>

With code

Partial Class Payment2
   Inherits System.Web.UI.Page

   Sub Page_Load(ByVal S As Object, ByVal E As EventArgs)

   End Sub

End Class

And I want to be able to inject the following String into the page and display.

<form name="downloadform3D" action="https://something.asp" method="post">
<NOSCRIPT>
JavaScript is currently disabled or is not supported by your browser.<br>
Please click on the &quot;Continue&quot; button to continue<br>
<input class="ncol" type="submit" value="Continue" id="submit1" name="submit1" />
</NOSCRIPT>
<input type="hidden" name="CSRFKEY" value="abc" />
<input type="hidden" name="CSRFTS" value="abc" />
<input type="hidden" name="CSRFSP" value="/ncol/test/something.asp" />
<input type="hidden" name="PaReq" value="<?xml version=&quot;1.0&quot;?><ThreeDSecure><Message id=&quot;123&quot;><PAReq><version>1.02</version><Merchant><merID>abc</merID><name>abc</name><url>http://www.abc.com</url></Merchant><Purchase><xid>123</xid><amount>1</amount><purchAmount>1</purchAmount><currency>GBP</currency></Purchase><CH><acctID>12345</acctID><expiry>1234</expiry><selBrand></selBrand></CH></PAReq></Message></ThreeDSecure>
" />
<input type="hidden" name="TermUrl" value="https://something.asp" />
<input type="hidden" name="MD" value="12334" />
</form>
<form method="post" action="https://somethig.asp" name="uploadForm3D">
<input type="hidden" name="CSRFKEY" value="1234A" />
<input type="hidden" name="CSRFTS" value="1234" />
<input type="hidden" name="CSRFSP" value="/something.asp" />
<input type="hidden" name="branding" value="abc" />
</form>
<SCRIPT LANGUAGE="Javascript" >
<!--
var popupWin;
var submitpopupWin = 0;

function LoadPopup() {
if (self.name == null)  {
    self.name = "ogoneMain";
}
popupWin = window.open('about:blank', 'popupWin', 'height=400, width=390, status=yes, dependent=no, scrollbars=yes, resizable=no');
if (popupWin != null) {
    if  (!popupWin || popupWin.closed) {
        return 1;
    } else {
        if (!popupWin.opener || popupWin.opener == null) {
            popupWin.opener = self;
        }
        self.document.forms.downloadform3D.target = 'popupWin';
        if (submitpopupWin == 1) {
            self.document.forms.downloadform3D.submit();
        }
        popupWin.focus();
        return 0;
    }
} else {
    return 1;
}
}
self.document.forms.downloadform3D.submit();
//-->
</SCRIPT>

I’ve had a look on google but nothing has helped (I may be entering the wrong search terms as I’m new to web programming). Any help would be really appreciated as I’m not an ASP guy and I’ve been pulling out what little hair I have left now for 3 days 🙁

Thanks in advance.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    you can do Response.Write,

    or

    you can use asp:Literal

    there are a few modes with the asp:Literal control

    PassThrough renders the content “as is” including html markup and script. This is a bad idea if you don’t complely control the output. If you are dynamically including anythin that would be taken from user input or values stored in database you could put yourself at security risk.

    Encode is HTML encoded. Its treated like text not HTML so this wont work for you

    Transform tries to change the markup to match the browser which may or may not work.

    Another option is to use a user control and set its “Visible” property on demand.

    • 0