Here's a second example of (possible) security problem. If it is as it seems to me, it
is worse then the dbEditAddROFlds security problem I've written about in the other mail,
because it would be heavier to add self made security checks on each page, for this
kind of problem.

Consider this simple asp page (let's call it dbEditDropFldsSecurityExample.asp):

<%
Set MyDb = Server.CreateObject(&#34;ASP.db&#34 &#39; Create the ASP-db object
MyDb.dbUnit = 100
MyDb.dbDSN = &#34;nwind&#34;
MyDb.dbSQL = &#34;SELECT EmployeeID, LastName, FirstName, Title, ReportsTo FROM Employees&#34;
MyDb.dbFormDisplayFlds = &#34;-1&#34;
MyDb.dbNavigationItem = &#34;Update&#34;
MyDb.dbEditParams = &#34;TableName=Employees, BookMarkFlds=0&#34;
MyDb.dbEditFlds = &#34;LastName,FirstName,Title,ReportsTo&#34;
MyDb.dbEditDropFlds = &#34;(;|)ReportsTo||||SELECT EmployeeID, FirstName & &#39; &#39; & &#34; &_
&#34;LastName AS Name FROM Employees where lastName=&#39;Fuller&#39; or lastName=&#39;Buchanan&#39;&#34;
MyDb.ASPdb &#39; Display it!
%>

I don&#39;t want the user to select a ReportsTo field value other then 2 or 5, the EmployeeIds of
Fuller and Buchanan respectively. But, as a user, I did it!

Let&#39;s look how I did it.

I&#39;ve called dbEditDropFldsSecurityExample.asp in my browser. Then I chose the UPDATE link.
I&#39;ve downloaded the produced update page html code, and I&#39;ve got something like this:

<Center><h3>Update current record</h3></Center>
<CENTER><FORM NAME=EDFORM_100 ACTION=&#34;/aspdb/trials/dbEditDropFldsSecurityExample.asp#ASPDB_100&#34; METHOD=POST >
<P><TABLE BGCOLOr=#ffffff cellspacing=5 border=0>
<TR><th BGCOLOR=#99CCFF><font color=#0000cc>Field</font></th><th BGCOLoR=#99CCFF >
<font color=#0000cc>Current Record</font></th></TR>
<Tr><th align=right BGCOLoR=#99CCFF ><font color=#0000cc>LastName &nbsp;</font></th>
<TD align=left><INPUT NAME=&#34;LastName&#34; TYPE=TEXT MAXLENGTH=20 SIZE=20 VALUE=&#39;Davolio&#39;></TD></TR>
<Tr><th align=right BGCOLoR=#99CCFF ><font color=#0000cc>FirstName &nbsp;</font></th>
<TD align=left><INPUT NAME=&#34;FirstName&#34; TYPE=TEXT MAXLENGTH=10 SIZE=10 VALUE=&#39;Nancy&#39;></TD></TR>
<Tr><th align=right BGCOLoR=#99CCFF ><font color=#0000cc>Title &nbsp;</font></th>
<TD align=left><INPUT NAME=&#34;Title&#34; TYPE=TEXT MAXLENGTH=30 SIZE=25 VALUE=&#39;Sales Representative&#39;>
</TD></TR><Tr><th align=right BGCOLoR=#99CCFF ><font color=#0000cc>ReportsTo &nbsp;</font></th>
<TD align=left>
<SELECT name=&#34;ReportsTo&#34;>
<option value=&#39;&#39;> </option>
<option SELECTED value=&#39;2&#39;>Andrew Fuller</option>
<option value=&#39;5&#39;>Steven Buchanan</option>
</select>
</TD></TR><tr align=centeR><th valign=middle ROWSPAN=3 BGCOLoR=#99CCFF >
<A HREF=&#34;/aspdb/prove/sicurezzaDbEditDropFlds.asp?aspDBBut_100=aspDBgoFo rm::0&#34;>
<font color=#0000cc>Cancel</font></A>&nbsp;<BR>
<A HREF=&#34;/aspdb/prove/sicurezzaDbEditDropFlds.asp?aspDBBut_100=aspDBEdit Drop&#34;>
<font color=#0000cc>DropDown ?</font></A></th>
<td ROWSPAN=3 align=center valign=middle>
<INPUT TYPE=Submit NAME=aspDBEditBut_100 VALUE=&#39;Update Current Record&#39;>
<INPUT TYPE=HIDDEN NAME=aspDBClick_100 VALUE=applyupdate>
<INPUT TYPE=HIDDEN NAME=aspDBUnit VALUE=&#39;_100&#39;><br>
<INPUT TYPE=Reset VALUE=&#39;Reset&#39;></Td></tr></TABLE></CENTER><br>
<center><font size=-1>Record Update/Delete Criteria : EmployeeID = 1</font></center>
<BR></FORM><A NAME=ASPDB_100> </A>

Then I&#39;ve changed the ACTION attribute of the FORM element to something like
&#34;http://glauco/trials/dbEditDropFldsSecurityExample.asp#ASPDB_101&#34;.
Furthermore, I&#39;ve added the following OPTION element, to the SELECT content:
<option value=&#39;7&#39;>Robert King</option>.
I called the obtained html file dbEditDropFldsSecurityExample.htm and I put it on my desktop.
Then I loaded dbEditDropFldsSecurityExample.htm into my browser and I chose the &#39;Robert King&#39;
option from the drop down list.
The &#39;Davolio&#39; record ReportsTo field was updated to 7 (!)
while I was hoping for either an error message or something like this.

Please, give me an answer to such security issue. I&#39;m going to deploy AspDb for a
B2B portal, and I need such security controls: for example, I don&#39;t want a company employed to
be able to change attributes of a different company product

Thanks in advance.