ASP.NET (VB Version) check if Zip Code exists If not, show a message. : Code Entry

No Captcha ReCaptcha 2.0 with ASP.NET (VB Version)

Current Code Entry

ASP.NET (VB Version) check if Zip Code exists If not, show a message.

Article Entry Date: July 30,2022 @ 06:18:27 / Last Updated On: August 14,2022 @ 05:54:10

In An ASP.NET VB Version US Zip Code lookup form, find any zip code in the US in this easy-to-use code.
In this example, we will be using [ASP.NET (VB)].
When the user enters their Zip Code into the form, we will do the following.
(Protecting our Database from XSS Attacks)
Date: 07-30-2022 - Name changed of Function from ProtectSQL to ProtectXSS, as It was brought to my attention that saying SQL was misleading.

#1: Use a function that will protect our database from [XSS] attacks called: [ProtectXSS]
#2: Check the value from the form against our database.
#3: Protect our Database from [SQL injection] using [Parameterized Queries].
#4: If the Zip Code [Does exist], we will display a message to the user, letting them know that the Zip Code exists
#5: If the Zip Code [Does not exist], we will display a message letting them know it does not exist.

The database comes with over 5,000 Zip Code entries and is available through the [Source Code] below.
[Section #1:]
The script we use to protect ourselves from XSS and SQL Injections is also available below and demonstrated in the demo code.
Example of the ProtectXSS code.

<%
Dim ZC As String = ProtectXSS(Zip.Text)
%>

To use the Function with our ASP.NET website, we need to add the following line to our @ Page.
ValidateRequest="False"
And inside our Web.config, we need the following.
The below information was found on HasanG from stackoverflow«

<configuration>
   <system.web>
      <httpRuntime requestValidationMode="2.0" />
   </system.web>
</configuration>

[Section #3:]
To protect ourselves from SQL Injections, we need to use [Parameterized Queries].
This unsafe query was rapidly available when I first started learning ASP Classic.
(You can find examples of this poor code all over forums dating back to the late 90s and 2000s.

Select Zip, City, State, County from ZipTable = " & request.form("Zip")

A protected Query for ASP.NET: (Works for VB.net and C#)

            Dim getZip As New SqlCommand("select Zip, City, State, County from ZipTable where Zip=@Zip", LessonCon)
            getZip.Parameters.Add(New SqlParameter("@Zip", ZC))

Other Articles Related to this Entry.

ASP Classic check if Zip Code exists. If not, show a message«
ASP.NET (C# Version) check if Zip Code exists. If not, show a message.«

Format Your SQL Script

About Company

Top Viewed Articles