First I included the MD5 function in both the sending and form handling pages as it isn’t included with ASP

<!--#include file="md5.asp"-->

Then I defined a variable for the hashed SessionID

Dim strHashedSessionID
strHashedSessionID = MD5(Session.SessionID)

Next I added the hashed SessionID to the querystring of the form handling page

<form method="post" action="formhandler.asp?sender=">

On the form handling page, I added a server-side error message, generated only if the two values don’t match

<%
If Not Request.QueryString("sender") = strHashedSessionID Then
 Response.Write "Authentication error: Please re-sumbit the form"
End If
%>

Finally, if the two values do match, the email is sent

<%
If Request.QueryString("sender") = strHashedSessionID Then
 'send the email using CDOSYS
End If
%>

After adding some additional server-side form validation, I added the additional security scripting to my contact form.

If you have a form on your site that interacts with a database (e.g. a username/password login form), you should secure the form by adding an additional stage between submission and the database look-up. One way to do this is to check for valid content.

As usenames and passwords are usually strings of alphanumeric characters, you can strip out ‘bad’ characters from the input string.
The easiest way to do this is to collect the form’s input and check each character against a regular expression, removing any that are invalid.

The code below removes all non-alphanumeric characters from the input string:

<%
'gets the text submitted via a form
Dim strUsername, strPassword
strUsername = Request.Form("username")
strPassword = Request.Form("password")

'call the function to use
strUsername = stripString(strUsername)
strPassword = stripString(strPassword)

'function to strip all non-alphnumric characters
function stripString(strInput)
 Dim objRE
 Set objRE = New RegExp
 With objRE
  .Pattern = "[^A-Za-z0-9]"
  .Global = True
 End With
 stripChars = objRE.Replace(strInput, "")
 Set objRE = nothing
End Function
%>