Enable Parent Paths Is Disabled by Default in IIS 6.0

SYMPTOMS

When you try to view an Active Server Pages (ASP) page that is running on Internet Information Services (IIS) 6.0, you may receive one of the following error messages in your browser:

If the Show Friendly Http Error Messages check box in Microsoft Internet Explorer is not selected:

Server.MapPath()error 'ASP 0175 : 80004005' Disallowed Path Characters

or

ASP error 0131 The include file <%filename.ext%> cannot contain '..' to indicate the parent directory. /<%path%>/<%filename.ext%>, line <%number%>

If the Show Friendly Http Error Messages check box in Microsoft Internet Explorer is selected:

The Page Cannot Be Displayed

or

HTTP 500-Internal server error

CAUSE

You receive this error message if the application calls an ASP method that requires the Parent Paths option to be enabled. The exact error message depends on the method that is being called.

By default, the Parent Paths option is enabled in IIS 5.0, but it is disabled by default in IIS 6.0.

MORE INFORMATION

The Parent Paths option (the AspEnableParentPaths metabase property) permits you to use ".." in calls to functions such as MapPath by allowing paths that are relative to the current directory using the ..\notation. Setting this property to True may constitute a security risk because an include path can access critical or confidential files outside the root directory of the application.

If your application contains a Web page that contains the #include server-side include directive and uses ".." notation to refer to a parent directory, you will experience this issue when the application is run on IIS 6.0 with the default setting.

HOW TO SOLVE

To resolve this problem without changing the application:

1. Click Start, click Administrative Tools, and then click Internet Information Services (IIS) Manager.
2. Double-click your computer name in the left pane, and then double-click Web Sites.
3. Locate the Web site and directory that houses the ASP application.
4. Right-click the application site or directory, and then click Properties.
5. Select Home Directory, and then click Configuration.
6. Click Options, and then click to select the Enable Parent Paths check box.
7. Click OK two times.

Source : http://support.microsoft.com/kb/332117

How do I comment blocks of ASP code?

Many people get frustrated because VBScript doesn't allow you to comment blocks of code; instead, a REM or ' is required before every line. Other languages, such as Java, JavaScript, Perl, and T-SQL allow the use of delimiters such as /* comments */ which allow you to comment single or multiple lines without much fuss. So is there a way to do this in VBScript as well?

Yes! Here are two ways of preventing a block of code from writing... the first requires two comments to make it run / not run, the second requires one line change.

<‰ 
    Sub doNotExecuteThisCode 
        For Each x In Request.Form 
            Response.Write x & "<br>" 
        Next 
        Response.End 
    End Sub 
‰>

Now, to execute the code again, simply comment the Sub and End Sub lines:

<‰ 
    'Sub doNotExecuteThisCode 
        For Each x In Request.Form 
            Response.Write x & "<br>" 
        Next 
        Response.End 
    'End Sub 
‰>

The following method uses simple logic to enter a code block.

<‰ 
    ExecuteCodeBlock = FALSE 
    If ExecuteCodeBlock Then 
        For Each x In Request.Form 
            Response.Write x & "<br>" 
        Next 
        Response.End 
    End If 
‰>

Now, to execute the code again, simply change the value of ExecuteCodeBlock to TRUE:

<‰ 
    ExecuteCodeBlock = TRUE 
    If ExecuteCodeBlock Then 
        For Each x In Request.Form 
            Response.Write x & "<br>" 
        Next 
        Response.End 
    End If 
‰>

FWIW, the latter method is a little less efficient, since the If logic is actually tested. I use it all the time, however, since it's much easier to set a debug flag on or off to affect a group of blocks of code.

Source : http://classicasp.aspfaq.com/