Web Hosting Talk : Web Hosting Main Forums : Programming Discussion : ASP question

[jonat8]

Hi,

I have an ASP script that creates a RealOne ActiveX object and the file source for the player to play comes from a QueryString, i.e. mypage.asp?cliptoplay=whatever.smil

But if the .smil file did not exist in the directory, which could happen if for whatever reason the user typed in random jargon instead of whatever.smil, or if there was nothing passed in QueryString then I just get RealOne saying "A General Error Has Occured" (it's slang for File Not Found)

How can I avoid this? I am primarily interested in inhibiting the errors if no QueryString is passed, as I doubt users will be into the habit of typing random filenames into the querystring!

The code I am using at the moment is:

<%
clipfile=Request.QueryString("cliptoplay")
%>
<center>
<object id=RAOCX classid="clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA" height="36" width="350">
			<param name="CONTROLS" value="ControlPanel">
			<param name="CONSOLE" value="sound1">
			<param name="AUTOSTART" value="true">
			<param name="SRC" value="rtsp://ip-address/jlmedia/<% Response.Write clipfile %>">
			
	
</object>

The only thing I could think of is to use IF clipfile<>"" THEN ... then Response.Writing my object parameters etc. and then ELSE Response.Write("Filename not found, please try again") So the RealOne ActiveX doesn't load if nothing is found in the QueryString

Is this the best way or is there a better way to achieve this?

Thanks
Jonathan.

[ActivI]

xpto = Request.QueryString("cliptoplay")
if xpto <> "" to check if the querystring is not null can be an option

To check if the file exists or not you'll have to use FileSystemObject

Best regards

[Burhan]

You can also have an array of valid files that you want to serve, and compare the query string to those.

Another option would be to eliminate the filename completely, and use some other reference (cliptoplay=654) ... so that the user can't type in invalid filenames.

You would then need to link up the numbers with the filenames (similar to the array example).

[ActivI]

Originally posted by fyrestrtr
You can also have an array of valid files that you want to serve, and compare the query string to those.

Another option would be to eliminate the filename completely, and use some other reference (cliptoplay=654) ... so that the user can't type in invalid filenames.

You would then need to link up the numbers with the filenames (similar to the array example).

Wouldn't it be alot of unecessary work with the "other reference way"?

I supose u would need an intermediate databse or so to associate numbers with filenames... This if your files won't have the "new reference as well"

Regards

[Burhan]

Define "unnecessary work"?

You don't need a database.

Furthermore, with the way he is doing it right now ... anyone can use his site to stream file that are in that directory that are not streams, just to exploit his program.

The solution I described doesn't require a database.

Just an array, which has keys that are nothing more than indexes to the value. Every array has some sort of index (which is how you would reference and object from that array). Just using the index would solve the majority of his problems, not to mention add another functionality to his script.

Say he has 30 files he wants to stream, but only 10 that he wants to make public. With his current solution (or your solution of checking if empty), if someone is able to guess the name of the file, they can get it to stream.

With the array solution, you can limit what files to make public.

[ActivI]

Originally posted by fyrestrtr
Define "unnecessary work"?

You don't need a database.

Furthermore, with the way he is doing it right now ... anyone can use his site to stream file that are in that directory that are not streams, just to exploit his program.

The solution I described doesn't require a database.

Just an array, which has keys that are nothing more than indexes to the value. Every array has some sort of index (which is how you would reference and object from that array). Just using the index would solve the majority of his problems, not to mention add another functionality to his script.

Say he has 30 files he wants to stream, but only 10 that he wants to make public. With his current solution (or your solution of checking if empty), if someone is able to guess the name of the file, they can get it to stream.

With the array solution, you can limit what files to make public.

I understood your point of view now

I've used something like this more than once.
Wasn't to stream files... but same method