[wdvltalk] Re: Avoid the address toolbar

2003-07-18 Thread Furry, Tim 
Peter asked:
> Is there a way that programmatically we can deactivate
> the address toolbar whenever a specific page is loaded?

rudy suggested:
you can open the page in a popup window with no chrome
but that approach has problems too
specifically:  smart users can figure that out

your time would be better spent not trying to prevent them from doing
that, but dealing with the situation constructively

assume there'll always be somebody who tries to hack the url

Tim:
I spent a good deal of time working on our site assuming the user would
hack the URL. In my case, most of it is protecting against SQL injection
hacks, but there's a couple of places where it would just lead them off
into 404 land.  rudy's suggestion of handling the situation
constructively is the best solution, even though it's the most work.

Tim
___ 
Tim Furry
Web Developer 
Foulston Siefkin LLP 




 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED]
   Send Your Posts To: [EMAIL PROTECTED]
To set a personal password send an email to [EMAIL PROTECTED] with the words: "set 
WDVLTALK pw=yourpassword" in the body of the email.
To change subscription settings to the wdvltalk digest version:
http://wdvl.internet.com/WDVL/Forum/#sub

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]

[wdvltalk] Re: Avoid the address toolbar

2003-07-18 Thread Stephen Caudill 
Peter,

  I have to agree with Rudy wholeheartedly.  I think you're treading on dangerous 
ground when you start altering base browser behavior.  And as one of those "smart 
users" all that would do is make me more determined to do what you were attempting to 
keep me from doing.  You pop a window and I control-N to get a new chromed one.  You 
disable the address bar with javascript, I turn javascript off... etc.

  I think the best way to deal with users modifying querystring parameters is to 
handle the exceptions.  If they insist on doing it, let them, just be prepared.  If 
they are merely navigating to valid pages using the querystring, there shouldn't be 
any problem (let them feel smart).  If they are getting 404's or some other error, 
then you should be handling that in your scripts.  Let us know what you are 
encountering and we might be able to help.

-Stephen
http://www.mechavox.com

On Thursday, July 17, 2003 7:13 PM, rudy commented:
 
: yes, i sure do have ideas -- always   ;o)
: 
: your time would be better spent not trying to prevent them from doing
: that, but dealing with the situation constructively
: 
: assume there'll always be somebody who tries to hack the url
: 
: basically, and i'm trying to be helpful here -- so what?
: 
: what happens if they do?
: 
: rudy

 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED]
   Send Your Posts To: [EMAIL PROTECTED]
To set a personal password send an email to [EMAIL PROTECTED] with the words: "set 
WDVLTALK pw=yourpassword" in the body of the email.
To change subscription settings to the wdvltalk digest version:
http://wdvl.internet.com/WDVL/Forum/#sub

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]