RE: Session variables security

2011-01-26 Thread Andrew Scott
/ -Original Message- From: Rob Voyle [mailto:robvo...@voyle.com] Sent: Wednesday, 26 January 2011 5:09 PM To: Andrew Scott; cf-talk@houseoffusion.com Subject: Re: Session variables security Hi Andrew have you used this firewall or others that are out there? I find I have a great

Re: Session variables security

2011-01-25 Thread Rob Voyle
Hi Folks I have several large forms connected to mySql tables. I use cfqueryparam when querying and inserting data from the form after it has been validated for content that I need (no blank fields etc.) I created the following validation to check for scripts etc being injected. Is there

RE: Session variables security

2011-01-25 Thread Andrew Scott
...@voyle.com] Sent: Wednesday, 26 January 2011 11:53 AM To: cf-talk Subject: Re: Session variables security Hi Folks I have several large forms connected to mySql tables. I use cfqueryparam when querying and inserting data from the form after it has been validated for content that I need

Re: Session variables security

2011-01-24 Thread Ian Skinner
On 1/24/2011 8:57 AM, Richard White wrote: Hi, When the user logs in, I save their username to the session scope. Would i need to re-validate that username at the top of every page that uses it in a database query? I previously thought this was not necessary but if it is possible for

Re: Session variables security

2011-01-24 Thread Richard White
OK thanks Ian On 1/24/2011 8:57 AM, Richard White wrote: Only if there is a place in your code for them to do so. If you have a vulnerable piece of code that can give unexpected and undesired results because of malicious inputs form the client, then you have a problem. But it is not an