% '============================================================================= ' FILE: displayprinter.asp ' PURPOSE: Display detailed printer information with edit capability ' SECURITY: Parameterized queries, HTML encoding, input validation ' UPDATED: 2025-10-27 - Migrated to secure patterns '============================================================================= %>
<% theme = Request.Cookies("theme") IF theme = "" THEN theme="bg-theme1" END IF '============================================================================= ' SECURITY: Validate printerid parameter '============================================================================= Dim printerid printerid = GetSafeInteger("QS", "printerid", 0, 1, 999999) IF printerid = 0 THEN objConn.Close Response.Redirect("default.asp") Response.End END IF '============================================================================= ' SECURITY: Use parameterized query to prevent SQL injection ' NOTE: Explicitly select printers.maptop and printers.mapleft (not from machines) '============================================================================= strSQL = "SELECT machines.*, models.*, vendors.*, printers.*, " &_ "printers.maptop AS printer_maptop, printers.mapleft AS printer_mapleft " &_ "FROM machines,models,vendors,printers WHERE " &_ "printers.machineid=machines.machineid AND "&_ "printers.modelid=models.modelnumberid AND "&_ "models.vendorid=vendors.vendorid AND "&_ "printers.printerid=?" set rs = ExecuteParameterizedQuery(objConn, strSQL, Array(printerid)) ' Check if printer exists If rs.EOF Then rs.Close Set rs = Nothing objConn.Close Response.Redirect("default.asp") Response.End End If Dim machineid machineid = rs("machineid") %>Vendor:
Model:
Serial:
Location:
IP:
FQDN:
PIN:
Driver:
CSF Name:
Windows Name:
<%=Server.HTMLEncode(vendorVal)%>
<% If modelVal <> "N/A" And rs("documentationpath") & "" <> "" Then Response.Write("" & Server.HTMLEncode(modelVal) & "") Else Response.Write(Server.HTMLEncode(modelVal)) End If %>
<%=Server.HTMLEncode(serialVal)%>
<% If machineVal <> "N/A" Then %> <%=Server.HTMLEncode(machineVal)%> <% Else Response.Write("N/A") End If %>
<% If ipVal <> "N/A" Then Response.Write("" & Server.HTMLEncode(ipVal) & "") Else Response.Write("N/A") End If %>
<% If fqdnVal <> "N/A" And fqdnVal <> "" Then Response.Write("" & Server.HTMLEncode(fqdnVal) & "") Else Response.Write("N/A") End If %>
<%=Server.HTMLEncode(pinVal)%>
<% ' Driver download - use icon link to maintain alignment IF rs("installpath") & "" <> "" THEN response.write (" Specific Installer") ELSE response.write (" Universal Installer") END IF %>
<%=Server.HTMLEncode(csfVal)%>
<%=Server.HTMLEncode(winNameVal)%>
" & Server.HTMLEncode(zabbixConnected) & "