ECommerce Infrastructure

1
E-CommerceInfrastructure Security

• Lecture 7
• HTML Forms
• VB Script
• Cookies

2
JavaScript vs. VBScript

• JavaScript is the client-side script standard
  because its supported in IE and Navigator
• VBScript is only supported in IE
• VBScript is the server-side script standard for
  ASP
• Well stick w/ VBScript in this course

3
Agenda

• HTML Forms Review
• VB Script
• Cookies

4
HTML Forms Review

• Allow users to enter information
• This information is then sent to server for
  processing
• ltFORM ACTIONfilenamegtcontrol tags
• lt/FORMgt

5
Common Form Components

• Input boxes (string)
• Password (string, but chars replaced by )
• Checkbox (on or off)
• Radio button group (select 1 from N)
• Text Area (free response/memo)
• Selection (drop down or fully-shown list)
• Buttons (reset, submit, misc.)

6
A Form Example

• http//newcollege.clayton.edu/itsk3413/Examples/la
  _survey.html

7
VB Script

• Useful for client and server side processing
• Well focus on client side for now
• ltSCRIPT LANGUAGEVBSCRIPTgt
• PROGRAM HERE
• lt/SCRIPTgt

8
Variables in VBScript

• All are of the variant type
• Weakly-typed
• May force declaration beforehand
• Use OPTION EXPLICIT
• DIM variable name,

9
VBScript Variables (cont)

• Option Explicit
• DIM intA, intB
• DIM strName, strPasswd
• intA 5
• intB intA
• strName 42 this is a number
• strname 42 this is a string

10
VBScript - Comments

• You can add comments to a line
• The computer will ignore everything to the right
  of the symbol
• strName 42 this is a number
• strname 42 this is a string

11
VBScript Type Conversion

• We can transform a string into a number
• Dim strAge, intAge
• strAge 42
• intAge CInt(strAge)

12
VBScript Conditionals

• Follow the standard if-then-else structure
• if (boolean expression) then
• TRUE STATEMENTS
• else
• FALSE STATEMENTS
• end if

13
VBScript Conditionals (cont)

• if (strName Jon) then
• MsgBox Hello Jon, _ vbInformation,
  Welcome
• else
• MsgBox Go away!, _ vbCritical, Leave
  Now!
• end if

14
VBScript Message Boxes

• MsgBox Hello Jon, _ vbInformation,
  Welcome
• MsgBox prompt, buttons, title

15
VBScript - Message Boxes (cont)

• Possible button parameters include
• vbInformation
• vbOKOnly
• vbOKCancel
• vbAbortRetryIgnore
• vbYesNoCancel
• vbYesNo
• vbCritical
• vbQuestion
• vbExclamation

16
VBScript - The _ Symbol

• Often, youll write code that spans more than one
  line
• To tell the computer to put these lines
  together, use the _ character
• MsgBox Hello Jon, _ vbInformation, Welcome

17
VBScript - Input Boxes

• You can also create dialog boxes which ask the
  user for input
• InputBox(PROMPT, TITLE, DEFAULT, X, Y, HELP)
• Example
• name InputBox(Please enter your name, _
  Name, , 200,200)

18
A Simple VBScript Example

• http//newcollege.clayton.edu/itsk3413/Examples/Ch
  22_Deitel/addition.html

19
VBScript - String Manipulation

• Concatenation of strings ( or )
• strWelcome Hello Bob
• strWelcome userid _ passwd

20
VBScript - String Manipulation (cont)

• InStr(string, sub-string)
• Returns position of sub-string (0-N)
• Len(string)
• Returns the length of the string
• Mid(string, start, length)
• Returns length characters from start of string
• StrComp(string1, string2)
• Returns 0 if equal, -1 if string1 lt string2, 1
  otherwise

21
A More Complex VBScript Example

• http//newcollege.clayton.edu/itsk3413/Examples/Ch
  22_Deitel/piglatin.html

22
VBScript - Objects Attributes

• What was all that . stuff?
• phrase Document.Forms(0).txtInput.Value

Attribute
Object
23
Another VBScript Example

• http//newcollege.clayton.edu/itsk3413/Examples/Ch
  22_Deitel/site.html

24
VBScript - Modules

• What about functions and subroutines (procedures)
• Sub ModuleExample (params)
• code here
• End Sub
• Function FunctionExample(params)
• code here
• FunctionExample RETURN_VALUE
• End Function

25
Another VBScript Example

• http//newcollege.clayton.edu/itsk3413/Examples/Ch
  22_Deitel/minimum.html

26
What Should You Know

• Display message boxes
• Display input boxes
• Declare and manipulate variables
• Conditionals
• Functions and Subroutines
• Accessing attributes of objects

27
Intermission
28
Storing Information

• Often, wed like to save information about a
  client-server session
• Has the visitor been to the site before
• Identification
• What are their preferences
• Shopping cart information, etc.

29
Cookies!

• We can store information on the client machine
  (or in the clients memory) via cookies

30
What is a Cookie?

• Simply a name/value pair
• Think of them as variables
• UserIDjonpreston
• The character separates the name from the
  value

31
Making Cookies

• Each Document object hasa Cookie attribute
• Use assignment as usual
• Document.Cookie UserID Document.frmLogin.tx
  tUserID.Value
• This creates a temporary cookie

32
A Whole Batch of Cookies

• A cookie file can containmultiple name/value
  pairs
• They are separated by the character, as in
• UserIDjonprestonPasswd12345

33
Writing Multiple Cookies

• Document.Cookie UserID Document.frmLogin.tx
  tUserID.Value
• Document.Cookie Passwd Document.frmLogin.tx
  tPasswd.Value
• The is automatically added in between

34
Accessing Cookies

• You can read the value of a cookie quite easily
• Document.Cookie

35
Getting at Individual Value from Name

• Function CookieValue(ByVal strCookieVarName)
• Dim intCookieVarNameLen, strCookieVal
• Dim intCookieValStart, intCookieValEnd,
  intCookieValLen
• 'find the length of the cookie variable name
• intCookieVarNameLen Len(strCookieVarName)
• 'determine if cookie variable is in cookie
• If InStr(Document.Cookie, strCookieVarName) 0
  Then
• 'cookie variable name not found in cookie
• CookieValue "Cookie value not found"
• Else
• 'cookie variable found, parse cookie to find
  cookie variable value
• intCookieValStart InStr(Document.Cookie,
  strCookieVarName) intCookieVarNameLen 1
• If InStr(intCookieValStart, Document.Cookie,
  "") 0 Then
• strCookieVal Mid(Document.Cookie,
  intCookieValStart)
• Else
• intCookieValEnd InStr(intCookieValStart,
  Document.Cookie, "")
• intCookieValLen intCookieValEnd -
  intCookieValStart
• strCookieVal Mid(Document.Cookie,
  intCookieValStart, intCookieValLen)
• End If

36
Stale Cookies

• The most tasty cookies are
• Temporary cookies
• Only stored within the browsers memory
• Stale cookies stay around longer
• Persistent cookies
• Stored within the client machines HD
• Live from session to session

37
Making Cookies Persistent

• Add an expiration to a name/value pair
• Document.Cookie UserID Document.frmLogin.tx
  tUserID.Value expiresTuesday, 31-Dec-2002
  120000 GMT

38
The Cookie Jar

• On Win 95/98 machines, cookies live in
• C\Windows\Temporary Internet Files
• You might have to dig around a bit there could
  be a bunch of junk in there!

39
Cookies a Two-Phase Process

• Store the cookie on the client machine
• Retrieve the cookie and send it to the server

40
Interesting Facts about Cookies

• Each cookie can only hold a maximum of 20
  name/values
• Oldest name/value pairs are dropped
• The maximum size of a cookie is 4096 bytes
• The maximum cookies per machine is 300

41
Security and Cookies

• Cookies expire and are removed from your system
• Cookies can only be read by the server that
  created the cookie
• But

42
Security Holes

• It is possible for other sites to hack into other
  sites saved cookie information on your machine
  using a malformed URL
• Microsoft released a patch to IE 5.01 on 5/18/00
  to fix this security problem

43
Rats in the Cookie Jar

• What if Web sites agreed to work with a third
  party?
• I could place an image tag in my html that loads
  a file and cookie from another site
• This site could then read/set cookie info

44
Targeted Marketing on the Web

• Some companies are designed to track your comings
  and goings on the web
• Doubleclick
• Focalink
• Globaltrack
• ADSmart
• They offer tailored banner ads based upon sites
  youve visited (user profile)

45
Exterminating the Rats

• Empty and change the attributes of the offending
  cookie file
• Disable cookies(IE options)

46
The Reality of Cookies

• You cant get a virus from cookies on your
  machine
• Size limit of the cookie helps a bit
• The real issue is privacy, anonymity, and whether
  you want information stored onto your computer

47
A Word Concerning Project 4

• Project 4 is a group project
• It will be based upon Chapter 7 in DDWS
• It will take a while to complete, so get ready!
• Teams of no more than 3 people (but 2 is optimal
  so everyone learns)
• More info to come

48
Stay Tuned for Project 3
FIN