All,

This maybe a dumb question - and I do believe it belongs here.

When I write code in ASP, sometimes there might be network traffic on the server and the ASP code will generate an error.

IE6 & IE7 errors are rather obscure. But Firefox will put it out there for all to see.

As I was securing my ASP programs more from SQL injection, when I was just doing an test on my test file (not up on the web), much to my horror the dbConnection string came up - complete with db server & password!

I use "try/catch" in JavaScript. What can I do for ASP?

Thanks
Donna

The Vbscript version of try/catch is "On Error Resume Next" or "On Error Goto something", however, I think something else must be going on here.

Firefox isn't doing anything special, it's just giving you whatever error message is being presented by the server. IE can have "simple error messages" turned off and it will display the same thing as firefox.

The real question is, why is your server showing that information when there's an error? IIS usually only says something like "Syntax error in line 161, file c:\inetpub\wwwroot\whatever"

What specific error message is showing your connection string? You're right, that's very very bad. I've never had that happen myself....

You're right that it's bad for security. The connection string is bad enough, but then if the stack trace gives an attacker any useful clue into how your application works, that's even worse. Try adding a custom errors section to your web.config file?

Firefox doesn't know whether an error happened or not; it's just displaying whatever's in the html it gets.

I'm not sure how useful this is as I've not actually used it myself but there is the ASPError Object.

http://www.w3schools.com/asp/asp_ref_error.asp

If you were running the code on "localhost" the error message can be more comprehensive than it would be remotely.

As I was securing my ASP programs more from SQL injection, when I was just doing an test on my test file (not up on the web), much to my horror the dbConnection string came up - complete with db server & password!

This sounds like a .NET error page, rather than an ASP error

This is only a security breach if it's being sent to your client, and if you're testing the page from the server itself, that wouldn't be the case. IIS runs some code like if(request.IP != reponse.IP) before spewing what you see.

Well I would think the connection would only display because your probably using it as a variable thats doing the "failing".

In classic ASP, connections strings are usually set globally.. in Application scope or as an include for your data provider scripts..
Generally when your script fails, IIS will generate a error code of 500. Other status codes like 404, and 403 deal with page access problems.. like it doesnt exist or you dont have security rights to browse the page..

So what I generally do is implment a global error handler and it makes life easier. If you have .NET enabled on your web site, you can put a <customErrors /> element in the <system.web> configuration of the web.config file.

something like:
<customErrors defaultRedirect ="GenericError.htm">
<error statusCode ="404" redirect ="PageNotFound.htm" />
<error statusCode ="500" redirect ="AppError.htm" />
</customErrors>

This will at least ensure that people are not seeing the stacktrace or server out. The other place to set that is in the IIS / virtual directory application configuration.. you can point it to custom files and or scripts.

If you are going all classic ASP, the best way to do error handling in line is what someone suggested earlier up in this thread.. On Error Resume Next is the key..

There are some whacky aspects of it though, that make it not as useful as it should be.. the idea if you say On Error Resume Next in your script, it will not fail directly on an error, but will instead populate an ASP object called "Err" that has a few properties like .Number and .Description that allow you to do what you want with the error.
The only problem is, its hard to trap individual errors in a stack like you get with the whole try/catch bubble up effect. So generally what I would do is one of two things..

1. you set On Error Resume Next at the begining of the script.. and at the very end you check the Err.Number property for something greater than 0... if there is an error, than convert it to your friendly message.
2. if you need a more grainular approach, like you have a series of tasks that could pass or fail and you need to know them individually.. what you can do is call On Error Resume Next at the begining of each of your custom functions. This resets the ASP Err object and that way you can create your own effecient Pass/fail collection and it gives you a bit of isolation of errors in each function.

An example template that I would use for unit testing functions in Classic ASP looks a little like this:

 
On Error Resume Next
'TEST FUNCTION TEMPLATE'
Function Template(ByRef HTMLResults, ByRef ErrorMsg) 'As Boolean
  If Err.Number <> 0 Then
     Template = False
     Exit Function
  End If
  On Error Resume Next  'Resets the Err object for isolated error trapping
  HTMLResults = HTMLResults & "<tr><td><b>Doing Something..</b></td>" 
 
  'Do Some code or something here..
 
  If Err.Number <> 0 Or ErrorMsg <> "" Then
     Template = False
     If Err.Number <> 0 Then
        ErrorMsg = "Template(): " & Err.Number & " / " & Err.Description
     End If
     HTMLResults = HTMLResults & "<td><font color='red'><b>FAILED!  [msg]:</b><font size='1'>" & ErrorMsg & "</font></font></td></tr>" & vbCrLF
  Else
     HTMLResults = HTMLResults & "<td><font color='green'><b>Passed</b></td></tr>" & vbCrLF
     Template = True
  End If
End Function 'Template

Obviously it has some of my own html for the test harness the script is from, but you should be able to get the idea..

Hope that helps!

RapidSniper - and all,

Thank you. Unfortunately I don't administer the actual website... I'm only an application developer.

There is .NET on the website as well... in fact, I was going to start learning that.

BTW, we are using a local host.

Thanks again,
Donna

If it's .NET, then just write your code in this style

try
{
//do something dangerous here, like divide by 0
}
catch(Exception ex)
{
if(user.Type == UserType.Admin)
   Response.Write("<strong style="color: red;">An error occured at " + DateTime.Now + "!  Details:</strong><br />" + ex.Message);
}
finally
{
//tidy up resources, if necessary
}