How to form post from C# - asp.net

I've an aspx form with a form tag as below and this form tag contains some sensitive info with hidden fields
<form id="payment_confirmation" target="myFrame" action='https://testsecureacceptance.cybersource.com/embedded/pay' method="post"/>
<input type="hidden" name="access_key" value="sensitivevalue1">
<input type="hidden" name="profile_id" value="sensitivevalue2">
<input type="hidden" name="transaction_uuid" value="<% Response.Write(getUUID()); %>">
<input type="hidden" name="signed_field_names" value="sensitivevalue3">
<input type="hidden" name="unsigned_field_names" value="card_type,card_number,card_expiry_date">
<input type="hidden" name="signed_date_time" value="<% Response.Write(getUTCDateTime()); %>">
<input type="hidden" name="locale" value="en">
<input type="submit" id="submit" name="submit" value="Submit"/>
</form>
When i click "Submit" it successfully post the values and user is "redirected" into the "https://testsecureacceptance.cybersource.com/embedded/pay" form but those hidden fields values are exposed to users (when they inspect the page). I can encrypt them but is there any other way i can post values and redirect from backend where values will not be exposed to users?
Thanks

In short, no. Hidden fields are only hidden from view on the screen and will always be available be available when viewing the source of the page when you are using web forms like this. You can use the viewstate, which will encode the fields and make them harder to read, but if it is truly sensitive information, you will need to properly encrypt that information.
Hope that helps.

Related

display external webpage inside shiny through a POST request

I am trying to put a button on my shiny app which calls out external website though a form/post request. The input values will change but here is a real example.
Example:
<form action="http://toppgene.cchmc.org/CheckInput.action" method="post">
<input type="hidden" name="query" value="TOPPFUN">
<input type="hidden" id="type" name="type" value="HGNC">
<input type="hidden" name="training_set" id="training_set" value="EGFR">
<input type="submit" class="mybutton">
</form>
PS: cross posted on shiny-discuss google group link
Thanks!
-Abhi

Payment Gateway module in dotnetnuke

I have done an interswitch payment gateway in my regular asp.net webform and asp.net mvc.
But I have a requirement to do the same in dotnetnuke which i know i can through module.
In my pay now pay of my application i have a form to send data across to interswitch webservice the form is below
<form name="form1" action="https://stageserv.interswitchng.com/test_paydirect/pay"
method="post">
<input name="product_id" type="hidden" value="XX" />
<input name="pay_item_id" type="hidden" value="XX" />
<input name="amount" type="hidden" value="XXXXXXX" />
<input name="currency" type="hidden" value="566" />
<input name="site_redirect_url" type="hidden" value="http://abc.com /getresponse”/>
<input name="txn_ref" type="hidden" value=" XXXAFTXXX”" />
<input name="hash" type="hidden" value="BB292DF9268F05CB9CBBC5E0C13CC1B13ACA34DC" />
</form>
I need someone to help me out on how i can implement this in my dotnetnukes module.
I faced a similar problem and asked this question. The accepted answer here is how I ended up doing it.
I just added the input fields to the page and then changed the "Pay" buttons PostBackUrl
This way you don't need to add an additional form to the page, and when the user clicks the button, it will submit those fields, so obviously it will pick up the ones it's looking for.
So in your case it would be:
<%-- other page content before --%>
<input name="product_id" type="hidden" value="XX" />
<input name="pay_item_id" type="hidden" value="XX" />
<input name="amount" type="hidden" value="XXXXXXX" />
<input name="currency" type="hidden" value="566" />
<input name="site_redirect_url" type="hidden" value="http://ipsum.com/getresponse”/>
<input name="txn_ref" type="hidden" value=" XXXAFTXXX”" />
<input name="hash" type="hidden" value="BB292DF9268F05CB9CBBC5E0C13CC1B13ACA34DC" />
<%-- pay button would look like this --%>
<asp:Button ID="btnPayNow" runat="server" PostBackUrl="https://stageserv.interswitchng.com/test_paydirect/pay" Text="Pay Now!" />
<%-- other page content after --%>
Of course if you have multiple payment gateway options you can set the PostBackUrl programatically before you display the form: btnPayNow.PostBackUrl = "http://<url>.com"
If you are posting to another site, not even anything on your site then you don't need a module at all.
With DNN you cannot include another form on your site like that. But you could make that a .html page and include that on your site as an iframe or something like that.
That should post to that other service fine.

Form post data to ASHX hidden fields

I have next form and some ashx
<form action="FileUpload.ashx" method="POST" enctype="multipart/form-data" id="frmUpload">
<input id="fileupload" type="file" name="files[]" />
<input id="viewId" type="hidden" />
<input id="moduleId" type="hidden" />
<button id="btnUpload" type="submit">Upload</button>
</form>
I can get file inside of ProcessRequest(HttpContext context)
context.Request.Files - file containe file information, but context.Request.Form["viewId"] is empty.
That should I do to get hidden fields values ?
Thanks.
You need to add the name="viewid" also. The name attribute is used when you make post, not the id
read also: HTML input - name vs. id in the line "Used on form elements to submit information"

Dynamic HTTP POST instead of form action in asp.net

I have a simple asp.net page where a form action is done, which it takes to the 3d party url and that will return some data as a response. How can I achieve the job done without using static form action.
Below is the form action:
<form name="theForm" method="GET" action="page.aspx" >
<input type="hidden" name="asp" value="hidden values" />
<input type="hidden" name="url" value="http://www.google.com" />
<input type="submit" name="submit" />
</form>
Thanks in Advance.

Paypal Form Inside ASP.NET Form

Cheers,
I have a problem with integrating Paypal Shopping Cart to my ASP.NET C# project.
The problem is that Paypal Shopping Cart is inside a FORM tag, so if I place that inside my server form tag it won't work.
It would look like this:
<body>
<form id="form1" runat="server">
<form target="_self" action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_cart">
<input type="hidden" name="business" value="MySecretEmail#hidden.com">
<input type="hidden" name="display" value="1">
<input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_viewcart_LG.gif" border="0" name="submit" alt="PayPal - The safer, easier way to pay online!">
<img alt="" border="0" src="https://www.paypalobjects.com/en_US/i/scr/pixel.gif" width="1" height="1">
</form>
</form>
</body>
Is there any way I can prevent this from happening? I've search on google and here on Stackoverflow where I found this link: PayPal Name-Value Pair API Basics, but honestly, it doesn't make any sense to me since I'm not a programmer.
Thank you!
The simplest way to solve this problem is to use the PostBackUrl property of the asp:button. Using this method, the ASP generates your JavaScript to handle the external post.
This allows the rendering of the form to happen correctly and doesn't require any workaround. Remember that as your code is already in a form tag, your paypal items don't need to be wrapped in an extra tag.
e.g.
<input type='hidden' name='cmd' value='_cart'/>
<input type='hidden' name='upload' value='1'/>
<input type='hidden' name='business' value='business#business.com'/>
<input type='hidden' name='currency_code' value='aud'/>
<input type='hidden' name='item_number_1' value='item number_1'>
<input type='hidden' name='item_name_1' value='16x16 inch square canvas'>
<input type='hidden' name='amount_1' value='70'>
<input type='hidden' name='item_number_2' value='item number_2'>
<input type='hidden' name='item_name_2' value=' 48x20 rectangular canvas'>
<input type='hidden' name='amount_2' value='104'>
<asp:Button ID="Button1" PostBackUrl='https://www.paypal.com/cgi-bin/webscr' runat="server" />
Hope this helps.
Technically, your example isn't valid HTML. In the longer term, you might be best refactoring this code to remove your 'technical debt'. (See "must not contain other form elements" under element prohibitions on the W3C site for XHTML 1.0)
In the meantime, you could try submitting the nested form with jQuery.
1. Replace Submit Button
<button class="submit-button" id="submit-button">Submit Payment</button>
2. Amend Form Tag
<form id="nested-form" target="_self" action="https://www.paypal.com/cgi-bin/webscr" method="post">
3. Submit form using jQuery
<script type="text/javascript">
$('#submit-button').live('click',function() {
$('#nested-form').submit();
});
</script>
I haven't had a chance to test this, so please test and let me know if it works for you.
Here's a very easy method. It's what I use exclusively so I know with 100% certainty that it works.
Create a "false" image only PayPal button.
User clicks this button (it's just an image)
This image has an onclick method which calls a 2 line javascript function (see below)
Put your "real" PayPal button form at the end of your page AFTER the closing form tag.
Enclose it in a SPAN tag with style="display:none;"
Add ID="ppsubmit" to the "real" button's image input
When user click the false button, the onclick method calls a javascript function that does just 2 things ... a) changes span display to inline and b) automatically clicks the real PayPal button.
<form id="form1" runat="server">
<!-- Here's the image only "false" paypal button -->
<input type="image"
src="https://www.sandbox.paypal.com/en_US/i/btn/btn_subscribeCC_LG.gif"
border="0" name="submit" alt="PayPal - The safer, easier way to pay online!"
onclick="javascript:doPPform();" />
</form> <!-- this closes your asp.net form -->
<!-- Here's the hidden span with the real paypal button
at the bottom of your webpage -->
<span id="ppform" style="display: none;">
<form action="https://www.sandbox.paypal.com/cgi-bin/webscr" method="post"
target="_top">
<input type="hidden" name="cmd" value="_s-xclick">
<input type="hidden" name="hosted_button_id" value="xxxxx">
<input id="ppsubmit" type="image"
src="https://www.sandbox.paypal.com/en_US/i/btn/btn_subscribeCC_LG.gif"
border="0" name="submit"
alt="PayPal - The safer, easier way to pay online!">
<img alt="" border="0"
src="https://www.sandbox.paypal.com/en_US/i/scr/pixel.gif"
width="1" height="1">
</form>
</span>
<!-- Here's the 2 line javascript code when the user clicks the "false" button -->
<script language="javascript" type="text/javascript">
function doPPform() {
document.getElementById("ppform").style.display = "inline";
document.getElementById("ppsubmit").click();
}
</script>
A quick solution would be to put the paypal form inside an iframe.
On the form element, change target="_parent" so it posts back to the parent page.
Why don't you make the page the payment form is on use a MasterPage that has the tag removed. I do this on all the sites and it works without problems.
I discovered the PayPal button problem before I discovered that it is an ASP.NET problem.
In the process of creating buttons and adding to my page, sometimes they would work and sometimes they would not. Then I would have 2 identical buttons and the second would work and the first would not. Remove the first and then the button that worked would not. To get to the point if I added a form tag before my PayPal button the Paypal button works.
<%-- simple form tag --%>
<form action="">
</form>
<form action="https://www.sandbox.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_xclick">
<input type="hidden" name="business" value="hughet_1335403121_biz#yahoo.com">
<input type="hidden" name="lc" value="US">
<input id="iptItemName" type="hidden" name="item_name" value="testBuyNow">
<input type="hidden" name="amount" value="10.00">
<input type="hidden" name="currency_code" value="USD">
<input type="hidden" name="button_subtype" value="products">
<input type="hidden" name="no_note" value="0">
<input type="hidden" name="cn" value="Add special instructions to the seller">
<input type="hidden" name="no_shipping" value="2">
<input type="hidden" name="bn"
value="PP-BuyNowBF:btn_buynowCC_LG.gif:NonHosted">
<input type="image"
src="https://www.sandbox.paypal.com/en_US/i/btn/btn_buynowCC_LG.gif"
border="0" name="submit" alt="PayPal - The safer, easier way to pay online!">
<img alt="" border="0"
src="https://www.sandbox.paypal.com/en_US/i/scr/pixel.gif"
width="1" height="1">
</form>
I understand this a "hack fix", and I'm not sure why this works. Curious if this works for others.

Resources