Hi,

Using UD4's standard page security behaviours to secure a page leaves the page open to an SQL injection attack, I have been aware of the flaw in the code for a long time but a clients site was hacked this morning because of it so I am keen to find a fix. I don't want to hand edit the code because that will break the behaviour in GUI mode.

Any help would be very much appreciated, Thanks,
Kevin

obviously we dont want to discuss here how this behaviour is vulnerable to an SQL injection in here, but as the username and password fields of your login form are very easily protected i dont see how the page protection could be circumvented.

please email me to discuss further

ASP|VBScript|IIS5.1|WinXPPro & WinXPHome