Question

I’m trying to add some Input Validation in Classic ASP by using the function/code seen below.
The only one that looks like it’s working correctly is the “text” type. the others I keep getting errors or it just does not filter correctly.
I’m trying to understand what I’m doing wrong please help me.

Valid Data Types: “email”, “integer”, “date”, “string” and “text”.
The first three are obvious, the last two have slight differences.

The “email” should only allow numbers and leters, and the following characters “@” , “–” , “.” , “_“

The “date” should validate by running IsDate and if True then allow if False DON’T.

The “string” should validate text-based querystrings, allowing only letters, numbers, _, – and .

Whereas “text” is any free-form text form field type content.

The “integer” should only allow numbers and a period (.)

Usage Example: <input type="text" value="<%=MakeSafe("[e-mail]</HTML>1234.5",integer,50)%>">

Eg: MakeSafe(dataInput,dataType,dataLength)

<%
'// CODE BY: dB Masters
'// FOUND AT: http://successontheweb.blogspot.com/2008/03/input-validation-for-security-in.html

Function MakeSafeConvert(encodeData)
encodeData = replace(encodeData,"&", "&#38;")
encodeData = replace(encodeData,"'", "&#39;")
encodeData = replace(encodeData,"""", "&quot;")
encodeData = replace(encodeData,">", "&gt;")
encodeData = replace(encodeData,"<", "&lt;")
encodeData = replace(encodeData,")", "&#41;")
encodeData = replace(encodeData,"(", "&#40;")
encodeData = replace(encodeData,"]", "&#93;")
encodeData = replace(encodeData,"[", "&#91;")
encodeData = replace(encodeData,"}", "&#125;")
encodeData = replace(encodeData,"{", "&#123;")
encodeData = replace(encodeData,"--", "&#45;&#45;")
encodeData = replace(encodeData,"=", "&#61;")
MakeSafeConvert = encodeData
End Function

Function MakeSafe(dataInput,dataType,dataLength)

Dim regex, validInput, expressionmatch
regex = ""
validInput = "1"

If dataType = "string" And Len(dataInput) > 0 Then
    regex = "^[\w-\.]{1,"& dataLength &"}$"
ElseIf dataType = "email" And Len(dataInput) > 0 Then
    regex = "^[\w-\.]+@([\w-]+\.)+[\w-]{2,6}$"
ElseIf dataType = "integer" And Len(dataInput) > 0 Then
    regex = "^\d{1,"& dataLength &"}$"
ElseIf dataType = "date" And Len(dataInput) > 0 Then
If Not IsDate(dataInput) Then validInput = "0" End If
ElseIf dataType = "text" And Len(dataInput) > 0 Then
If Len(dataInput) > dataLength Then validInput = "0" End If
End If

If Len(regex) > 0 And Len(dataInput) > 0 Then
    Set RegExpObj = New RegExp
    RegExpObj.Pattern = regex
    RegExpObj.IgnoreCase = True
    RegExpObj.Global = True
    RegExpChk = RegExpObj.Test(dataInput)

If Not RegExpChk Then
    validInput = "0"
    End If
    Set RegExpObj = nothing
End If

If validInput = "1" And Len(dataInput) > 0 Then
    MakeSafe = MakeSafeConvert(dataInput)
    ElseIf Len(dataInput) = 0 Then
    MakeSafe = ""
Else
    Response.Write "<h2>Processing Halted.</h2>"
    Response.End
End If

End Function
%>

EXAMPLE CODE AND ERROR(S):

When I test this using the code:

<%=MakeSafe(“[e-mail]1234.5”,email,50)%>
* Does NOT Validate Anything.*

I don’t get an error message but it DOES NOT Validate anything.

**The OUTPUT IS : [e-mail]1/27/20121234.5

SHOULD BE ONLY: [e-mail]**

When I test this using the code:

<%=MakeSafe(“[e-mail]1/27/20121234.5”,date,50)%>

I don’t get an error message but it DOES NOT Validate anything.

The OUTPUT IS : [e-mail]1/27/20121234.5
SHOULD BE ONLY: 1/27/2012

The other two give me this error message:

<%=MakeSafe(“[e-mail]1234.5”,string,50)%>
* ERROR!!! Wrong number of arguments or invalid property assignment: ‘string’

<%=MakeSafe(“[e-mail]1234.5”,integer,50)%>

* ERROR!!! Syntax error

Thank you so much for any help that you provide…

Answer 1

If it’s not a typo then your fault was in the second parameter of the function call.

You call the function like:

<%=MakeSafe("[e-mail]1234.5",email,50)%>

which is wrong because you should “…” the second parameter too. This should work:

<%=MakeSafe("[e-mail]1234.5","email",50)%>