How can you prevent a cookie from cross side script attacks?

Use HttpOnly property of the cookie when it is created.
It prevents the cookie from being accessible through Javascript.

ex:
HttpCookie h=new HttpCookie("userinfo");
h.HttpOnly=true;
h.Value="dd";
h.Expires=DateTime.Now.AddMinutes(3);
Response.Cookies.Add(h);

dynamic sql queries

Create PROCEDURE usp_demo (@TableName varchar(90),@ID varchar(90),@FName
varchar(90),@LName varchar(90),@PNum Varchar(90), @Email Varchar(90))
as
BEGIN
declare @SQL nvarchar(1000)
SELECT @SQL = 'Create Table ' + @TableName + ' ('SELECT @SQL = @SQL +'' +@ID+
' int NOT NULL Primary Key,' +@FName+ ' VarChar(10),' +@LName+ ' Varchar(90),'
+@PNum+ ' Varchar(90),' +@Email+ ' Varchar(90))'
SET @SQL = @SQL
EXECUTE SP_EXECUTESQL @SQL
END

identify hacking

ALTER PROCEDURE sp_IsValidLogon
@UserName varchar(16),
@Password varchar(16)
As
if exists(Select * From User_Table
Where UserName = @UserName
And
Password = @Password
And
Active = 1)
begin
return(1)
end
else
begin
INSERT INTO FailedLogons(UserName, Password)
values(@UserName, @Password)

declare @totalFails int
Select @totalFails = Count(*) From FailedLogons
Where UserName = @UserName
And dtFailed > GetDate()-1
if (@totalFails > 5)
UPDATE User_Table Set Active = 0
Where UserName = @UserName
return(0)
end
Go



Now, let's take a closer look at what I was doing. First thing, check to see if the
username and password exist on the same row, and that that user is active, if so, login is fine, return 1 to the
user and exit the procedure. If the login is not ok though, we want to log it. The first
thing the procedure does is insert the record into the 'FailedLogons' table.
Next we declare a variable to hold the number of failed logons for that same day. Next we
assign that value by using a sql statement to retrieve the number of records for that username,
within the same day. If that number is greater than 5, it's likely someone is trying to
hack that account so the the username will be disabled by setting the active flag in the
'User_Table' to 0. Finally, return 0 letting the calling code (ASP) know that
the login was unsuccessful. To accomplish this same task using only ASP, you would have
needed to make 4 database calls. The way we just did it it is still only one database call,
plus the fact that all that functionality we added at the end was in the stored procedure,
we didn't have to touch the ASP code at all!


Note about 'begin/end': When using an 'If' statement in a stored procedure, as long
as you keep the conditional code to one line you won't need a 'begin' or
'end' statement.

Note about 'begin/end': When using an 'If' statement in a stored procedure, as long
as you keep the conditional code to one line you won't need a 'begin' or
'end' statement. Example:


if (@myvar=1)
return(1)
else
return(2)



However, if you need more than one line, it is required that you use begin
and end. Example:


if (@myvar=1)
begin
do this.....
and this.....
return(1)
end
else
begin
do this....
return(2)
end

What is the purpose of "sp_resetstatus" system stored procedure ?

This system stored procedure is used to reset the database status from SUSPECT to normal.

The following are the considerations :
1. You should be under 'sysadmin' server role.
2. Should not be under Transaction. It will throw an err as follows
i.e: The procedure 'sp_resetstatus' cannot be executed within a transaction.
3. Database name should be valid and available
i.e: The database '' does not exist. Supply a valid database name. To see available databases, use sys.databases
4. The database should not be a snapshot. It should be a source database.
i.e: Cannot run sp_resetstatus against a database snapshot.
5. The database should be already in SUSPECT mode.
i.e: The suspect flag on the database "" is already reset.

Input field -get value

problem

It is not possible in asp.net to get value in server side without runat=server tag but the problem solved



Solution

It’s simple: Request.Form returns NameValueCollection. GetValues is a NameValueCollection class method which gives us the requested result.
Request.Form.GetValues(”txtSomeText”) returns a string array with all the values.

Operator ===

Have you ever used the strict equal operator? I learned about it few days ago…
Below is a quick explanation of its behavior:

"The strict equal to operator returns true if both operands are equal (and of the same type). It doesn't perform any data type conversion, so an expression like 1 === true returns false and 1 === "1" also returns false, because this operator checks for the type of the operands. 1 is a numerical value and “1″ is a string value; their types are different."

Hid Div and white spaces it occupy

Pic the div by there ID and hide it through Jquery or javascript .I m here just doing with it by javascript.


Problem


Most of the developers will say “I can use javascript and CSS ‘visibility’ property to do that”, but shortly after that they’ll realize that this is not enough. This solution will hide the div tag content, but the space it occupies will stay.

You can reproduce this behavior using the code below:

if (objDiv.style.visibility == 'visible' ||
objDiv.style.visibility == '')
{
objDiv.style.visibility = 'hidden';
}
else
{
objDiv.style.visibility = 'visible';
}
where objDiv is the div object which you’re trying to hide.

Solution

It’s simple - initialize “display” property in addition. So the above code will look like:

if (objDiv.style.visibility == 'visible' ||
objDiv.style.visibility == '')
{
objDiv.style.visibility = 'hidden';
objDiv.style.display = 'none';
}
else
{
objDiv.style.visibility = 'visible';
objDiv.style.display = 'block';
}
css, div, hide, javascript white space