From the Washington Post, April 25, 2008:

Quote... Hundreds of thousands of Web sites - including several at the United Nations and in the U.K. government -- have been hacked recently and seeded with code that tries to exploit security flaws in Microsoft Windows to install malicious software on visitors' machines. Unquote...

Apparently there have been an estimated half-million attacks on different Web sites this week alone. There seems to have been a rush to judgement in trying to point the finger of blame at a recent Microsoft Security Advisory (951306). According to Bill Staples, Product Unit Manager for IIS, "Microsoft has investigated these reports and determined that the attacks are not related to the recent Microsoft Security Advisory (951306) or any known security issues related to IIS 6.0, ASP, ASP.Net or Microsoft SQL technologies."

These attacks are not related to said security advisory but are aimed at sites, on any platform, that are open to SQL Injection. What we are really seeing is a growth in SQL Injection over other types of attack. Although around for a long time now, this technique has been gaining in popularity among hackers over the last couple of years, and seems to be more popular now than cross-site scripting or buffer overflow exploits. I would argue that this would not be the case for ASP.NET sites if basic input validation and SQL parameters in combination with stored procedures were employed, as is the recommended practice.

At the very least, even if you are still using ASP and haven't time to convert to stored procedures, check your input data! All input data is evil and when designing your application you should take time to consider where else that input may be coming from, such as query parameters, cookies, etc. Watch this space...

I neglected to point out that the code I posted for this previously was created in VS 2005 running on XP Professional. I'm going to update the code here and do a quick walkthrough of the steps necessary to get this working in Visual Studio 2008 running on Vista. You can find the download links at the end of this article.

Although I don't recommend moving projects from one version of VS to another willy-nilly (it takes very little time to get it up and running from scratch), if you are having problems moving a project between VS versions, you might want to check the version number at the top of the solution file; for VS 2005 you would find something like Version 9.00. When moving a VS 2005 project to VS 2008, you might try changing the 9 to a 10.

I plan on following up some more on this Guest Book application and showing how to develop an administrative back end for it. Right now ,the moderator functionality is built in, in that the 'live' field is not set by default. So, if you want your comment to appear, you will have to change this field value to 'true' manually in the database. The Guestbook table design is shown below.

The App_Code folder refused to play nice in the VS 2008 Web project, so I renamed the folder "Layers". Other than that, the code is the same. I've only been using Vista for a few weeks so I'll defer judgement until after the full SP1 release. For developers, I would recommend turning off the User Account Control (UAC) to get rid of those demented pop-ups. This is still a version 2.0 application, so be sure to select this option if creating your project from scratch in VS. Sometimes I will build my own project incrementally as I study other people's code that I have downloaded, just as a learning exercise :-)

One of the first things you will notice when moving to this environment is the completely new IIS 7 interface. It's 100% different and I'm finding it a joy to work with. In order to get the application running, you will first have to check some IIS 7 settings. ASP.NET is more integrated than ever before with IIS; no more dependency on command line line utilities like aspnet_regiis.exe – so do not run it to install ASP.NET!

In IIS, select the Application Pools node and set the Managed Pipeline for the DefaultAppPool to “Classic” in the Application Pools view. You will also need to create a virtual directory. You can do this (or pretty much anything else) from within the new IIS console, but I still prefer to perform this task from within the IDE. Right-click on the project node in solution explorer and select properties. On the Web tab of the properties manager, opt to create a virtual directory. Now, right-click on Default Web Site node in IIS 7 and opt to add a virtual directory. Navigate to the Guestbook folder and select it. Also, don't forget to set Default.aspx as the default page in IIS. In your browser, navigate to http://localhost/guestbook to bring up the home page.

If you start getting security errors, try adding appropriate permissions to the folder in question. If you get the following error:

HTTP 401.2 - Unauthorized: Logon failed due to server configuration
Internet Information Services

...in IIS 7, navigate to and highlight the Guestbook node. In the Category view to the right, double-click on the Authentication icon under Security. Right-click the Windows Authentication entry and opt to enable Windows Authentication. (KB 253667)

The database is very simple; one table and two stored procedures. Create the Guestbook database manually in SQL Server Management Studio (SSMS) and run the three scripts in your query window. Set up your permissions as shown below and you should be good to go.

GuestBook-VS2005.zip (74.70 kb)

Guest_Book_DB.zip (3.13 kb)