Skip to main content

Past Blast

Featured Products

Windows Mobile Developer Controls
Windows Mobile Developer Controls
Stay in touch using the DEVBUSS RSS feeds.
 

News

Windows Mobile Developer Controls
Windows Mobile Developer Controls

Encrypting HTTP Form data with CryptoTextCE

Written by Tom Glover  [author's bio]  [read 39324 times]
Edited by Derek

Download the code

Page 1  Page 2 

Finally, some error checking to check that the order has been successfully transferred. Successfully uploaded orders are flagged with a 1 in the Listbox.Itemdata, for removal from the list at a later date.

    ' check response for success text
    If Len(xmlhttp.responseText) > 0 Then

      If InStr( _
         1, _
         xmlhttp.responseText, _
         "New row added to database", _
         vbTextCompare) > 0 Then

        MsgBox "Uploaded order: " & _
        listDB.List(i) & _
        " successfully."

        listDB.ItemData(i) = 1

      Else

        MsgBox "Failed uploading order: " & _
        listDB.List(i) 
        Exit Sub

      End If

    Else

      MsgBox "Failed uploading order: " & _
      listDB.List(i)
      Exit Sub

    End If

  Next

End Sub

The ASP Web Page

On the server side the orders.asp upload page displays the current contents of the database underneath a standard HTML Form. The asp script embedded in the <HEAD> section checks to see if any form elements have been supplied to it in the HTTP request, and if so validates the data and then executes an SQL Insert statement against a simple Access database. If an encrypted version of the credit card number has been supplied, the script uses the desktop version of CryptoText to decode it:

If Len(Request.Form("SubmitOrder")) > 0 Then

  ' validate input
  dt = Request.Form("OrderDate")
  cn = Request.Form("CustomerName")
  cc = Request.Form("CreditCardNumber")
  ecc = Request.Form("EncCreditCardNumber")
  am = Request.Form("Amount")

  If (Len(cc) > 0 And Len(ecc) > 0) Then

    Msg = "ERROR: please complete EITHER " & _
          "the plaintext Credit Card " & _
          "number OR the encrypted version."

  Else If (Len(dt) > 0 And Len(cn) > 0 And _
          (Len(cc) > 0 Or Len(ecc) > 0) _
          And Len(am)) Then

    If (Len(ecc) > 0) Then

      ' Decrypt
      Dim cry
      Set cry = Server.CreateObject( _
                "CryptoText.Encoder")
      cc = cry.Decrypt("13qeadzc#", ecc)

    End If

    Set conn = Server.CreateObject( _
               "ADODB.Connection")

    conn.Open("Provider=Microsoft.Jet.OLEDB.4.0;" & _
              "Password="""";User ID=Admin;" & _
              "Data Source=C:\orders.MDB;" & _
              "Mode=Share Deny None;")

    Set rs = Server.CreateObject( _
             "ADODB.Recordset")

    rs.Open "insert into orders " & _
            "(OrderDate," & _
            "CustomerName," & _
            "CreditCardNumber," & _
            "Amount) " & _ 
            "values ('" & _
            dt & "','" & _
            cn & "','" & _
            cc & "','" & _
            am & "')", conn

    Set rs = Nothing
    Msg = "New row added to database"

  End If
 
Else

    Msg = "ERROR: please check the data you entered."

End If

Summary

This is just a sample of the kind of application that can be built using a few lines of code and a few off-the-shelf components, I hope it stimulates your imagination to think of other applications and possibilities.

Sample Code Installation Notes

1. Make sure CryptoTextCE for your platform is registered (using regsvrce.exe) on your device, and that CryptoText is registered (using regsvr32.exe) on your webserver. See the readme files of each of these components for further information. An alternative quick way to transfer CryptoTextCE.dll on your target platform and register it is to use the Control Manager in eVB (eVB>Tools Menu>Remote Tools>Control Manager) - select the platform (eg Pocket PC 2002 Emulation) and then right click on the right hand pane to select 'Add New Control...' navigate to the appropriate subfolder of CryptoTextCE (X86 for PPC2002) and select the dll.

2. Make sure that the sample orders.mdb database is located in the root directory of your C: drive, or alter the database connection strings in orders.asp.

3. Make sure that the sample database (orders.mdb) can be written to by the account that your asp script is executing under on your webserver. By default, if your server is called PLUTO the account would be IUSR_PLUTO. Set the security settings on the database file from the Properties tab in File Explorer to allow this user full control over orders.mdb.

4. Copy the orders.asp webpage to your webserver's root folder - usually C:\Inetpub\wwwroot.

5. The Pocket PC application needs the url of the orders.asp page setting in its Form_Load event. This will be in the form http://yourwebservername/orders.asp.

6. Note that two versions of the sample eVB application are provided - one for PocketPC 2000 and one for Pocket PC 2002.

Previous Page