/    Sign up×
Community /Pin to ProfileBookmark

writing to a text file using a onSubmit function

We are trying to develop code that writes to a text file using request.query string(donor) to bring in a member number and using two radio buttons that have values of Yes or No. So our end results in the text file should be: 123456789, N

We have code that is writing the member number(donor) to the text file before the submit button is clicked. We only want it to write to the text file once the submit button is clicked. Also, it is not reading the value of the radio buttons. We think we need to call a function from the submit button, but not sure how to do it. Here is the code:
<%@LANGUAGE=”VBSCRIPT” CODEPAGE=”1252″%>
<%

strdonor = request.QueryString(“donor”)

Dim objFSO
Dim TSO
MyFile = Server.MapPath(“/emlnotic.txt”)

Set objFSO = Server.CreateObject(“Scripting.FileSystemObject”)
Set TSO = objFSO.OpenTextFile(MyFile,8)
TSO.Write strdonor & vbcrlf

TSO.close
Set TSO=nothing
Set objFSO=nothing
%>

<html >
<head>
<meta http-equiv=”Content-Type” content=”text/html; charset=iso-8859-1″ />
<title>Untitled Document</title>
</head>

<body>
<table width=”46%” border=”0″ align=”center”>
<tr>
<td>&nbsp;</td>
</tr>
<tr>
<td><font size=”2″ face=”Verdana”>By selecting this link you are requesting to stop receiving emails from the Association.</font></td>
</tr>
<tr>
<td><div align=”center”><b>Member #</b><%=Request.QueryString(“donor”)%></div></td>
</tr>
<tr>
<td>&nbsp;</td>
</tr>
<tr>
<td><font face=”Verdana”><font size=”2″>Would you like to continue receiving emails from us?</font></font></td>
</tr>
<tr>
<td>
<form action=”updatednew.asp” method=”post”>
<p>
<input name=”Subscribed” type=”radio” value=”y” checked /> Yes, continue to send me emails. </p>
<p>

<input name=”Subscribed” type=”radio” value=”n” /> No, remove me from your email list. </p>
<p>
<input name=”Submit” type=”submit” value=”Submit” />
</p>
</form>
</td>

</tr>

</table>
</body>
</html>

to post a comment
JavaScript

9 Comments(s)

Copy linkTweet thisAlerts:
@Angry_Black_ManOct 29.2007 — you said We only want it to write to the text file once the submit button is clicked[/quote] to make that happen, remove :

&lt;%@LANGUAGE="VBSCRIPT" CODEPAGE="1252"%&gt;
&lt;%
strdonor = request.QueryString("donor")

Dim objFSO
Dim TSO
MyFile = Server.MapPath("/emlnotic.txt")

Set objFSO = Server.CreateObject("Scripting.FileSystemObject")
Set TSO = objFSO.OpenTextFile(MyFile,8)
TSO.Write strdonor &amp; vbcrlf

TSO.close
Set TSO=nothing
Set objFSO=nothing
%&gt;


from the page with the form on it. and add, into your form:

&lt;input name="donor" type="hidden" value="&lt;%=Request.QueryString("donor")%&gt;"&gt;

and then, on "updatenew.asp", this is where you do the text file writing using the request.querystring values for "donor" and "subscribed".
Copy linkTweet thisAlerts:
@slaughtersOct 29.2007 — If I ever wanted to view someone else's member number all I would need to do would be to type http://[I]yourURL[/I]/emlnotic.txt in my web browser.
Copy linkTweet thisAlerts:
@sauermaauthorOct 29.2007 — I tried this, but it did not write anything to the text file--any other suggestions?
Copy linkTweet thisAlerts:
@Angry_Black_ManOct 29.2007 — does this code:

&lt;input name="donor" type="hidden" value="&lt;%=Request.QueryString("donor")%&gt;"&gt;

produce the following HTML once you run the ASP page

&lt;input name="donor" type="hidden" value="[I][COLOR="Red"]a_correct_donor_number[/COLOR][/I]"&gt;

then, remove all the coding on "updatednew.asp" and put just this:

&lt;%=Request.QueryString%&gt;

what does it show? even if you screwed up a little of your HTML, you should still get a whatever POST values you sent to "updatednew.asp" by outputting everything.

if it shows the proper response, then youre screwing up how youre accessing those variables in your real "updatednew.asp" page.
Copy linkTweet thisAlerts:
@sauermaauthorOct 29.2007 — I did get this to work....thank you!!!!!

Do you have a suggestion on getting around the unsecure viewing of our text file from a browser?
Copy linkTweet thisAlerts:
@Angry_Black_ManOct 30.2007 — i wouldnt stress that. just change the text file's name to something different than you used in this thread. no one on the client side (unless they can seriously hack) would ever see that code since it is processed server side.

i assume the only reason he made that point was because you posted this question in javascript, but provided ASP coding. he probably assumes the stuff between the ASP tags was javascript? but anyway, you have nothing at all to worry about if you change the text file's name.
Copy linkTweet thisAlerts:
@slaughtersOct 30.2007 — If you are posting sensitive information of any kind then leaving it in a clear unencrypted text file on your server is silly. Heck, doing it through an HTTP vs an HTTPS connection is even sillier.

The only time I would feel comfortable doing something like this would be on an Intranet. Even in that case it would have to be low volume non-critical data

Connect to a database via an ODBC connection. Use HTTPS. If you do not have Oracle or SQL Server available then you can at least use MS Access (as long as volume remains light - which it must be if you are thinking of using TXT files anyway)

P.S. Aaron Martinas - How is it that using VBScript would make it OK ?
Copy linkTweet thisAlerts:
@Angry_Black_ManOct 30.2007 — riddle me this: if a person had no idea how the data was being saved, wether it was being written to a text file, a csv, a database of some sort, or imprinted into a jpeg image, or whatever, how would they know how to get at the file in question?

just answer that question directly. dont workaround and justify.
Copy linkTweet thisAlerts:
@slaughtersOct 30.2007 — riddle me this: if a person had no idea how the data was being saved....[/QUOTE]

http://en.wikipedia.org/wiki/Man-in-the-middle_attack

http://www.vandyke.com/solutions/ssh_overview/ssh_overview_threats.html

http://en.wikipedia.org/wiki/Stream_cipher_attack#Substitution_attack

http://support.microsoft.com/kb/232449

[edit]

For got to mention the most common - Disgruntled employee attack. ?

One fired employee later and everyone knows the name of the file and can get to it because it is not secured.

[/edit]
×

Success!

Help @sauerma spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 BETA 5.19,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @AriseFacilitySolutions09,
tipped: article
amount: 1000 SATS,

tipper: @Yussuf4331,
tipped: article
amount: 1000 SATS,

tipper: @darkwebsites540,
tipped: article
amount: 10 SATS,
)...