Building Web Pages with ASP

ASP (Active Server Pages) is Microsoft's server-side web technology. It runs on IIS, and pages mix server code with HTML. ASP.NET Core is the current direction, but many existing systems still use classic ASP with VBScript. This article explains how requests are handled, how forms are read, and the practices to know.

Testing note: the computer used to write this article has no IIS or ASP, so the code has not been run here. Install IIS with ASP and test it yourself before using it.

What you need

Windows with IIS (Internet Information Services) and the ASP feature enabled
A web folder in IIS, for example `C:\inetpub\wwwroot\demo`

How it works

Diagram: the browser sends a request to an ASP page on IIS and receives HTML back

Your first ASP page

Create `hello.asp` and type:

<%@ Language="VBScript" %>
<html>
<body>
  <h1>สวัสดี ASP</h1>
  <p>เวลาบนเซิร์ฟเวอร์: <%= Now() %></p>
</body>
</html>

`<% ... %>` is code that runs on the server, and `<%= ... %>` writes a value into the HTML sent back to the browser.

Reading form data

<%@ Language="VBScript" %>
<%
Dim name
name = Request.Form("name")
%>
<form method="post" action="greet.asp">
  ชื่อ: <input type="text" name="name">
  <input type="submit" value="ส่ง">
</form>
<% If name <> "" Then %>
  <p>ยินดีต้อนรับ <%= Server.HTMLEncode(name) %></p>
<% End If %>

`Request.Form` reads the submitted value. `Server.HTMLEncode` prevents users from injecting HTML or scripts into the page.

Connecting to a database

Classic ASP usually uses ADO to connect to databases. Always use parameters rather than joining user input directly into SQL text, which would allow SQL injection.

Common mistakes

**Printing user input without encoding:** always use `Server.HTMLEncode`.
**Building SQL text from user input:** this allows SQL injection. Use commands with parameters.
**ASP feature not enabled in IIS:** the page shows source code instead of output. Check the feature installation first.

Next steps

For new projects, consider ASP.NET Core, which is actively maintained. Existing ASP systems should be moved gradually, with security checks added along the way.

Summary

ASP runs code on the server through IIS and mixes it with HTML. The key points are encoding displayed values and using parameters when talking to databases.