You searched for the word(s): userid:878873

More Search Options

RSS Available

• Re: Anonymous access and LOGON_USER

  Thanks for the link, but I already read up on this before I posted here -- looks like it's just buggy behavior resulting from an unusual or unexpected combination of settings. I'm using Forms authentication with anonymous access enabled, and per this article should never be getting LOGON_USER with anything other than blank. However, I do get LOGON_USER sometimes. This is an intranet app that requires authentication for some features but not others, and so disabling anonymous access was not

  Posted to Security (Forum) by nothingisnecessary on 7/13/2009

• Re: Avoid SQL Injection attacks

  A purely academic question to SQL Server gurus: Is there a way (a database setting or data provider option) to disable or disallow multiple statements being executed by Mssql? Please do me a favor and spare me any answers of "use stored procedures," "sanitize your input," "run as an unprivileged user," etc. (Y'all have already made several good points in this thread, and I'm aware of the best practices, but like I said, this is just a purely academic question

  Posted to FAQ - Frequently Asked Questions (Forum) by nothingisnecessary on 7/2/2009

• Anonymous access and LOGON_USER

  Posts across the web, and even the official MS Docs are pretty clear on the fact that when IIS has anonymous access enabled, the LOGON_USER variable is NEVER populated. However, sometimes... it is. Why? When Anonymous Access is disabled, the LOGON_USER is always sent, but with Anonymous Access enabled, it usually doesn't send, even though it sends it some times (about 15% of the time in my experiments). I've seen this behavior consistently between different configurations of IIS 5 and 6,

  Posted to Security (Forum) by nothingisnecessary on 7/2/2009