Huy guys.

I'm developing a site that Using ASP vbscript. This site simply pulls information back from a DB.

It uses the request.servervariable.("LOGON_USER") to figure out which user to pull back information in. for example if i log on to my computer and then visit the site it show my info. if you did it it would show your info.

Now these has got to be secure so i cant see yours and you cant see mine.

All the security is controlled by the request.servervariable.("LOGON_USER") how easy it for people to hack into this and pretend to be some one else?

edit: Not asking how if possible its done. Just if it is possible and how to stop people doing it

to use LOGON_USER you have to be using Windows Authentication, which is pretty secure provided you aren't sending clear text passwords.

ok thanks. for the info

what is your site link ?

Lemme check the security level and report back

reply lol. Luckly its a page on the local intranet so its not open to just anyone

Have you thought about protection from sql injection attacks? Something else you need to be aware of.

Have i thought about SQL injection attacks!!?

in a word no.

what the hell are they

ok. i know what they are now. Bloody hell thats quite scary.
But i dont have any input via users. Its all done via the Logon_user