It's been brought to my attention that the selectavatar.aspx file could be suseptible to SQL injection attacks since the sql statment is not using paramters. Here is the updated code. If you have any questions please contact me.
Private Sub Page_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
Dim objConn As New SqlClient.SqlConnection("Server=someserver;Database=somedatabase;uid=someuserid;pwd=somepassword;")
Dim objCommand As New SqlClient.SqlCommand
Dim sql As String
Dim PortalID As String
Dim UserID As String
Dim Avatar As String
Try
PortalID = Request.QueryString("pid")
UserID = Request.QueryString("uid")
Avatar = "/Portals/" & PortalID & "/SystemAvatar/" & Request.QueryString("avatar")
sql = "UPDATE NTForums_UserDetails SET AvatarLink=@Avatar, AvatarFileName='' WHERE PortalID=@PortalID AND UserID=@UserID"
objConn.Open()
objCommand.Connection = objConn
objCommand.CommandText = sql
objCommand.Parameters.Add("@Avatar", Avatar)
objCommand.Parameters.Add("@PortalID", PortalID)
objCommand.Parameters.Add("@UserID", UserID)
objCommand.ExecuteNonQuery()
Catch ex As Exception
Throw ex
Finally
objConn.Close()
objConn.Dispose()
objCommand.Dispose()
End Try
End Sub