views:

29

answers:

1

I have a problem when I send IE to the following location: http://fdvweb.mal/db/historikk/db_historikk_liste.asp?SQLfilter=SELECT TaKompHistorikk.*, TaKomponent.KompNummer, TaKomponent.KompNavn, TaKomponent.KompPlassering FROM TaKomponent RIGHT OUTER JOIN TaKompHistorikk ON [TaKomponent].[KompId]=[TaKompHistorikk].[KompHistorikkKompId] WHERE KompHistorikkSak = 'Servicerapport' AND (KompHistorikkStatusnummer <> '9999' OR IsNull(KompHistorikkStatusnummer) ) AND ((KompHistorikkStatusNavn <> 'OK' OR IsNull(KompHistorikkStatusNavn) ) OR ((KompHistorikkTittel <> '' OR KompHistorikkFritekst <> '') AND KompHistorikkTittel <> 'Kontrollert OK')) AND KompHistorikkDato >%3D %232/17/2010%23 ORDER BY KompNummer ASC (localhost, I've edited the hosts file). The source-code of the file db_historikk_liste.asp is as following:

<html>
   <head>
      <title>Test</title>
   </head>
   <body>
      <% Response.Write Request.QueryString("SQLfilter") %>
   </body>
</html>

However, IE gives me the error Internet Explorer has modified this page to help prevent cross-site scripting.

Anyone know how I can prevent this?

A: 

Try wrapping the query string portion in HttpUtility.UrlEncode()

Mike Mooney
You mean like `<% Response.Write HttpUtility.UrlEncode(Request.QueryString("SQLfilter")) %>`?
Alxandr