How to Turn Off ASP and SQL Error Messages

Hackers can easily glean insight from webpage error messages, which are like valuable jewels to them. The error messages are clues that help them break into your website and database. Setting up custom error pages is one of the most critical methods of hiding error messages to prevent valuable information from slipping into the wrong hands. However, setting up custom 404 error pages does not catch all the errors. Very detailed ASP script errors and SQL Server error messages are still broadcasted to potential hackers anytime there is a bug or break in the webpage code. The only way to protect these errors is to configure IIS 6 debugging so that it does not display itemized ASP and SQL script error messages.

Difficulty: Moderately Easy

Instructions

Things You'll Need:

• Internet Information Services 6

1. Open IIS 6

2. In left panel, click on the Websites Folder.

3. In the right panel, locate the website that you wish to configure. Right-click on the website and choose Properties.

4. The Properties box will popup. Choose the Home Directory tab.

5. Click on the Configuration button.

6. The Configuration box will popup. Choose the Debugging tab.

7. Ensure the Debugging flags are not checked.

8. Locate the section called Error Messages for Script Errors.

9. Do not select the option to Send Detailed ASP Messages to the Client. Instead, choose the radio button labeled Send the Following Text Message to the Client

10. 

    Click the OK button twice to save the changes.

11. See the examples below of ASP and SQL error messages.

12. Example Error 1:
    Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)
    [Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the character string ' AND a.aID=s.aID'.
    /homebase/bookreports/index.asp, line 20

13. Example Error 2:
    Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)
    [Microsoft][ODBC SQL Server Driver][SQL Server]Invalid column name 'bookTitle'.
    /homebase/bookreports/index.asp, line 33