Response .write for .ics file not allowing code to run

Question

I have an application that I am writing that dynamically builds an .ICS file by getting data input by a user. What I am trying to do is save the data to a database then offer the .ICS file for the user to download so they can add it to their calendar. I would like all of this to happen with one button click. The problem I am running into is when the button is clicked it is writing the file so the user is able to download it but it is not storing the data to the database. It stays on the page and doesn't appear to postback.

Public Sub AddToCalendar(ByVal Src As Object, ByVal e As EventArgs)              
Try        

    Dim Subject As String = setDBText(txtSubject.text)
    Dim Comment As String = setDBText(txtComment.text)
    Dim StartDate As String = setDBDate(txtStartDate.value,txtStartTime.text)
    Dim EndDate As String = setDBDate(txtEndDate.value,txtEndTime.text)

    sqlStr = "INSERT INTO tblActivity(Subject,Comment,StartDate,EndDate) " & _
             "VALUES(" & Subject & "," & Comment & "," & StartDate & "," & EndDate &")"
    dc.CommandText = sqlStr
    dc.ExecuteNonQuery()

    lblTest.Text = "New Event Sucessfully Added"                    

    '************
    '** CREATE CODE TO BUILD ICS FILE
    '************
    Dim sbICSFile As StringBuilder = New StringBuilder()
    Dim dtNow As DateTime = DateTime.Now

    sbICSFile.AppendLine("BEGIN:VCALENDAR")
    sbICSFile.AppendLine("VERSION:2.0")
    sbICSFile.AppendLine("PRODID:-//AkonaDev/CalendarAppointment")
    sbICSFile.AppendLine("CALSCALE:GREGORIAN")
    sbICSFile.AppendLine("BEGIN:VEVENT")

    ' Define time zones.
    ' US/Eastern
    sbICSFile.AppendLine("BEGIN:VTIMEZONE")
    sbICSFile.AppendLine("TZID:US/Eastern")
    sbICSFile.AppendLine("BEGIN:STANDARD")
    sbICSFile.AppendLine("DTSTART:20071104T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11")
    sbICSFile.AppendLine("TZOFFSETFROM:-0400")
    sbICSFile.AppendLine("TZOFFSETTO:-0500")
    sbICSFile.AppendLine("TZNAME:EST")
    sbICSFile.AppendLine("END:STANDARD")
    sbICSFile.AppendLine("BEGIN:DAYLIGHT")
    sbICSFile.AppendLine("DTSTART:20070311T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3")
    sbICSFile.AppendLine("TZOFFSETFROM:-0500")
    sbICSFile.AppendLine("TZOFFSETTO:-0400")
    sbICSFile.AppendLine("TZNAME:EDT")
    sbICSFile.AppendLine("END:DAYLIGHT")
    sbICSFile.AppendLine("END:VTIMEZONE")

    ' US/Central
    sbICSFile.AppendLine("BEGIN:VTIMEZONE")
    sbICSFile.AppendLine("TZID:US/Central")
    sbICSFile.AppendLine("BEGIN:STANDARD")
    sbICSFile.AppendLine("DTSTART:20071104T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11")
    sbICSFile.AppendLine("TZOFFSETFROM:-0500")
    sbICSFile.AppendLine("TZOFFSETTO:-0600")
    sbICSFile.AppendLine("TZNAME:CST")
    sbICSFile.AppendLine("END:STANDARD")
    sbICSFile.AppendLine("BEGIN:DAYLIGHT")
    sbICSFile.AppendLine("DTSTART:20070311T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3")
    sbICSFile.AppendLine("TZOFFSETFROM:-0600")
    sbICSFile.AppendLine("TZOFFSETTO:-0500")
    sbICSFile.AppendLine("TZNAME:CDT")
    sbICSFile.AppendLine("END:DAYLIGHT")

    sbICSFile.AppendLine("END:VTIMEZONE")

    ' US/Mountain
    sbICSFile.AppendLine("BEGIN:VTIMEZONE")
    sbICSFile.AppendLine("TZID:US/Mountain")
    sbICSFile.AppendLine("BEGIN:STANDARD")
    sbICSFile.AppendLine("DTSTART:20071104T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11")
    sbICSFile.AppendLine("TZOFFSETFROM:-0600")
    sbICSFile.AppendLine("TZOFFSETTO:-0700")
    sbICSFile.AppendLine("TZNAME:MST")
    sbICSFile.AppendLine("END:STANDARD")
    sbICSFile.AppendLine("BEGIN:DAYLIGHT")
    sbICSFile.AppendLine("DTSTART:20070311T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3")
    sbICSFile.AppendLine("TZOFFSETFROM:-0700")
    sbICSFile.AppendLine("TZOFFSETTO:-0600")
    sbICSFile.AppendLine("TZNAME:MDT")
    sbICSFile.AppendLine("END:DAYLIGHT")
    sbICSFile.AppendLine("END:VTIMEZONE")

    ' US/Pacific
    sbICSFile.AppendLine("BEGIN:VTIMEZONE")
    sbICSFile.AppendLine("TZID:US/Pacific")
    sbICSFile.AppendLine("BEGIN:STANDARD")
    sbICSFile.AppendLine("DTSTART:20071104T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11")
    sbICSFile.AppendLine("TZOFFSETFROM:-0700")
    sbICSFile.AppendLine("TZOFFSETTO:-0800")
    sbICSFile.AppendLine("TZNAME:PST")
    sbICSFile.AppendLine("END:STANDARD")
    sbICSFile.AppendLine("BEGIN:DAYLIGHT")
    sbICSFile.AppendLine("DTSTART:20070311T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3")
    sbICSFile.AppendLine("TZOFFSETFROM:-0800")
    sbICSFile.AppendLine("TZOFFSETTO:-0700")
    sbICSFile.AppendLine("TZNAME:PDT")
    sbICSFile.AppendLine("END:DAYLIGHT")
    sbICSFile.AppendLine("END:VTIMEZONE")

    ' Define the event
    sbICSFile.Append("DTSTART;TZID=" + ddlStartTZ.Text + ":")
    sbICSFile.Append(CDATE(txtStartDate.value).Year.ToString())
    sbICSFile.Append( _
        FormatDateTimeValue(CDATE(txtStartDate.value).Month))
    sbICSFile.Append( _
        FormatDateTimeValue(CDATE(txtStartDate.value).Day) + "T")
    sbICSFile.AppendLine(ddlStartTime.SelectedValue)

    sbICSFile.Append("DTEND;TZID=" + ddlEndTZ.Text + ":")
    sbICSFile.Append(CDATE(txtStartDate.value).Year)
    sbICSFile.Append( _
        FormatDateTimeValue(CDATE(txtStartDate.value).Month))
    sbICSFile.Append( _
        FormatDateTimeValue(CDATE(txtStartDate.value).Day) + "T")
    sbICSFile.AppendLine(ddlEndTime.SelectedValue)

    sbICSFile.AppendLine("SUMMARY:" + txtEventSubject.Text)
    sbICSFile.AppendLine("DESCRIPTION:" + txtEventDescription.Text)
    sbICSFile.AppendLine("UID:1")
    sbICSFile.AppendLine("SEQUENCE:0")

    sbICSFile.Append("DTSTAMP:" + dtNow.Year.ToString())
    sbICSFile.Append(FormatDateTimeValue(dtNow.Month))
    sbICSFile.Append(FormatDateTimeValue(dtNow.Day) + "T")
    sbICSFile.Append(FormatDateTimeValue(dtNow.Hour))
    sbICSFile.AppendLine(FormatDateTimeValue(dtNow.Minute) + "00")

    sbICSFile.AppendLine("END:VEVENT")
    sbICSFile.AppendLine("END:VCALENDAR")    

    Response.ContentType = "text/calendar"
    Response.AddHeader("content-disposition", _
        "attachment; filename=CalendarEvent1.ics")
    Response.Write(sbICSFile)
    Response.End()

Catch exc As Exception
    lblError.text = exc.toString       

End Try

You have everything in a try/catch.. When you debug, where does it fail? — InbetweenWeekends, Jun 28 '15 at 05:48
That's the thing, its not failing or throwing any errors. It is behaving as if it is completing, but after the page writes the file for download it does not appear to postback. Which I believe is why it is not saving the data to the database. — Jonathan, Jun 29 '15 at 13:23
This code is crazy-vulnerable to sql injection attacks. It's practically begging to get hacked. Use parameterized queries instead of string concatentation to build your sql statements. — Joel Coehoorn, Jun 29 '15 at 21:32

score 0 · Answer 1 · edited May 23 '17 at 10:26

The first thing I notice is that your INSERT statement appears to have some issues. (This is probably why the syntax coloring in your code block doesn't look right.) Strings are normally wrapped in single quotes. This should be causing an exception to be thrown, so I'm not sure how it's continuing past ExecuteNonQuery. I'd expect to see something more like this.

sqlStr = "INSERT INTO tblActivity(Subject,Comment,StartDate,EndDate) " & _
         "VALUES('" & Subject & "','" & Comment & "','" & StartDate & "','" & EndDate &"')"

The better alternative is a parameterized statement. Please read up on this. Your code as-is is vulnerable to SQL injection. How does SQLParameter prevent SQL Injection?

score 0 · Accepted Answer · edited Jun 29 '15 at 21:33

I found that the response can only do one of these things at a time. It cannot send a file and execute the server code. So what I did was create a separate "file download" page that handles the file download on page_load. To get the ICS file data to the file download page I created a session variable that gets filled on the button click of the submission page. Then I added an onClientClick event to the button and set it to a javascript function that opens a pop-up window to the file download page. This allowed the page to save the data to the database and display a file download prompt with a single button click.

Submission Page

Public Sub AddToCalendar(ByVal Src As Object, ByVal e As EventArgs)              
Try        

    Dim Subject As String = setDBText(txtSubject.text)
    Dim Comment As String = setDBText(txtComment.text)
    Dim StartDate As String = setDBDate(txtStartDate.text,txtStartTime.text)
    Dim EndDate As String = setDBDate(txtEndDate.text,txtEndTime.text)

    sqlStr = "INSERT INTO tblActivity(Subject,Comment,StartDate,EndDate) " & _
             "VALUES(" & Subject & "," & Comment & "," & StartDate & "," & EndDate &")" 
    dc.CommandText = sqlStr
    dc.ExecuteNonQuery()

    lblTest.Text = "New Event Sucessfully Added"                    

    '************
    '** CREATE CODE TO BUILD ICS FILE
    '************
    Dim sbICSFile As StringBuilder = New StringBuilder()
    Dim dtNow As DateTime = DateTime.Now

    sbICSFile.AppendLine("BEGIN:VCALENDAR")
    sbICSFile.AppendLine("VERSION:2.0")
    sbICSFile.AppendLine("PRODID:-//AkonaDev/CalendarAppointment")
    sbICSFile.AppendLine("CALSCALE:GREGORIAN")
    sbICSFile.AppendLine("BEGIN:VEVENT")

    ' Define time zones.
    ' US/Eastern
    sbICSFile.AppendLine("BEGIN:VTIMEZONE")
    sbICSFile.AppendLine("TZID:US/Eastern")
    sbICSFile.AppendLine("BEGIN:STANDARD")
    sbICSFile.AppendLine("DTSTART:20071104T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11")
    sbICSFile.AppendLine("TZOFFSETFROM:-0400")
    sbICSFile.AppendLine("TZOFFSETTO:-0500")
    sbICSFile.AppendLine("TZNAME:EST")
    sbICSFile.AppendLine("END:STANDARD")
    sbICSFile.AppendLine("BEGIN:DAYLIGHT")
    sbICSFile.AppendLine("DTSTART:20070311T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3")
    sbICSFile.AppendLine("TZOFFSETFROM:-0500")
    sbICSFile.AppendLine("TZOFFSETTO:-0400")
    sbICSFile.AppendLine("TZNAME:EDT")
    sbICSFile.AppendLine("END:DAYLIGHT")
    sbICSFile.AppendLine("END:VTIMEZONE")

    ' US/Central
    sbICSFile.AppendLine("BEGIN:VTIMEZONE")
    sbICSFile.AppendLine("TZID:US/Central")
    sbICSFile.AppendLine("BEGIN:STANDARD")
    sbICSFile.AppendLine("DTSTART:20071104T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11")
    sbICSFile.AppendLine("TZOFFSETFROM:-0500")
    sbICSFile.AppendLine("TZOFFSETTO:-0600")
    sbICSFile.AppendLine("TZNAME:CST")
    sbICSFile.AppendLine("END:STANDARD")
    sbICSFile.AppendLine("BEGIN:DAYLIGHT")
    sbICSFile.AppendLine("DTSTART:20070311T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3")
    sbICSFile.AppendLine("TZOFFSETFROM:-0600")
    sbICSFile.AppendLine("TZOFFSETTO:-0500")
    sbICSFile.AppendLine("TZNAME:CDT")
    sbICSFile.AppendLine("END:DAYLIGHT")

    sbICSFile.AppendLine("END:VTIMEZONE")

    ' US/Mountain
    sbICSFile.AppendLine("BEGIN:VTIMEZONE")
    sbICSFile.AppendLine("TZID:US/Mountain")
    sbICSFile.AppendLine("BEGIN:STANDARD")
    sbICSFile.AppendLine("DTSTART:20071104T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11")
    sbICSFile.AppendLine("TZOFFSETFROM:-0600")
    sbICSFile.AppendLine("TZOFFSETTO:-0700")
    sbICSFile.AppendLine("TZNAME:MST")
    sbICSFile.AppendLine("END:STANDARD")
    sbICSFile.AppendLine("BEGIN:DAYLIGHT")
    sbICSFile.AppendLine("DTSTART:20070311T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3")
    sbICSFile.AppendLine("TZOFFSETFROM:-0700")
    sbICSFile.AppendLine("TZOFFSETTO:-0600")
    sbICSFile.AppendLine("TZNAME:MDT")
    sbICSFile.AppendLine("END:DAYLIGHT")
    sbICSFile.AppendLine("END:VTIMEZONE")

    ' US/Pacific
    sbICSFile.AppendLine("BEGIN:VTIMEZONE")
    sbICSFile.AppendLine("TZID:US/Pacific")
    sbICSFile.AppendLine("BEGIN:STANDARD")
    sbICSFile.AppendLine("DTSTART:20071104T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11")
    sbICSFile.AppendLine("TZOFFSETFROM:-0700")
    sbICSFile.AppendLine("TZOFFSETTO:-0800")
    sbICSFile.AppendLine("TZNAME:PST")
    sbICSFile.AppendLine("END:STANDARD")
    sbICSFile.AppendLine("BEGIN:DAYLIGHT")
    sbICSFile.AppendLine("DTSTART:20070311T020000")
    sbICSFile.AppendLine("RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3")
    sbICSFile.AppendLine("TZOFFSETFROM:-0800")
    sbICSFile.AppendLine("TZOFFSETTO:-0700")
    sbICSFile.AppendLine("TZNAME:PDT")
    sbICSFile.AppendLine("END:DAYLIGHT")
    sbICSFile.AppendLine("END:VTIMEZONE")

    ' Define the event
    sbICSFile.Append("DTSTART;TZID=" + ddlStartTZ.Text + ":")
    sbICSFile.Append(CDATE(txtStartDate.value).Year.ToString())
    sbICSFile.Append( _
        FormatDateTimeValue(CDATE(txtStartDate.value).Month))
    sbICSFile.Append( _
        FormatDateTimeValue(CDATE(txtStartDate.value).Day) + "T")
    sbICSFile.AppendLine(ddlStartTime.SelectedValue)

    sbICSFile.Append("DTEND;TZID=" + ddlEndTZ.Text + ":")
    sbICSFile.Append(CDATE(txtStartDate.value).Year)
    sbICSFile.Append( _
        FormatDateTimeValue(CDATE(txtStartDate.value).Month))
    sbICSFile.Append( _
        FormatDateTimeValue(CDATE(txtStartDate.value).Day) + "T")
    sbICSFile.AppendLine(ddlEndTime.SelectedValue)

    sbICSFile.AppendLine("SUMMARY:" + txtEventSubject.Text)
    sbICSFile.AppendLine("DESCRIPTION:" + txtEventDescription.Text)
    sbICSFile.AppendLine("UID:1")
    sbICSFile.AppendLine("SEQUENCE:0")

    sbICSFile.Append("DTSTAMP:" + dtNow.Year.ToString())
    sbICSFile.Append(FormatDateTimeValue(dtNow.Month))
    sbICSFile.Append(FormatDateTimeValue(dtNow.Day) + "T")
    sbICSFile.Append(FormatDateTimeValue(dtNow.Hour))
    sbICSFile.AppendLine(FormatDateTimeValue(dtNow.Minute) + "00")

    sbICSFile.AppendLine("END:VEVENT")
    sbICSFile.AppendLine("END:VCALENDAR")    

    '** SET TO SESSION VARIABLE INSTEAD OF CALLING RESPONSE.WRITE **
    Session("ICSFile") = sbICSFile.ToString

Catch exc As Exception
    lblError.text = exc.toString       

End Try
End Sub

ICS File Download Page

Sub Page_Load(Src As Object, E As EventArgs)                              
Try
    '** GET ICS FILE FROM SESSION VARIABLE
    Dim ICSFile As String = Session("ICSFile").ToString

    Response.ContentType = "text/calendar"
    Response.AddHeader("content-disposition", "attachment; filename=CalendarEvent1.ics")
    Response.Write(ICSFile)
    Response.End()

Catch exc As Exception
    lblError.text = exc.toString
End Try         
End Sub

HTML

asp:Button ID="btnAddToCalendar" runat="server" OnClick="AddToCalendar" OnClientClick="javascript:DownloadICS();" Text="Add To Calendar" />

JavaScript

<script type="text/javascript" language="javascript">
 function DownloadICS() {
    popUp("ics_download.aspx", 300, 300);
}

function popUp(url, width, height) {
    if (window.featWin && !window.featWin.closed) {
        window.featWin.close();
        featWin = window.open(url, "win", 'toolbar=0,location=1,directories=0,status=0,menubar=0,scrollbars=1,resizable=1,width=' + width + ',height=' + height);
        selfWin = self;
        featWin.focus();
    }
    else {
        featWin = window.open(url, "win", 'toolbar=0,location=1,directories=0,status=0,menubar=0,scrollbars=1,resizable=1,width=' + width + ',height=' + height);
        selfWin = self;
        featWin.focus();
    }
}
function closeWin() {
    if (window.featWin && !window.featWin.closed) {
        window.featWin.close();
    }
}

A repsonse is certainly capable of doing both of those things. You can send one response to the client, but in the process of sending that one response you can execute any server code you like. The problem here is that you are trying to send two responses: one response with the *.ics file, and another response that updates the page in the browser. — Joel Coehoorn, Jun 29 '15 at 21:36
@Jonathon I would handle the UI changes in javascript. But the question implies that you don't fully understand what ASP.Net server code is doing when you cause a postback. — Joel Coehoorn, Jul 01 '15 at 15:04

Response .write for .ics file not allowing code to run

2 Answers2