Coldfusion: How to create an open forum to my website?

Try changing the name atribute to just index instead of index.cfm

I dont think it likes the .

 

Thanks! It worked.


So, I never learned how to create a registration page, so that users can create a username and password. So I wrote this (i think this should work). Let me know if you think it needs to be tweaked:


Register.cfm

<!--- Sets a variable to define the maximum file size allowed for an individual photo--->

<cfset maxFileSize = (150 * 1024)>
<cfform action="register.cfm" method="post" name="register_form" enctype="multipart/form-data" id="register_form">

<table width="95%">		
<tr>

<td width="20%" valign="top">
	<p>Desired username:
</td>

<td width="25%" valign="top">
	  	<cfinput name="username_name" 
			type="text" 
			value="" 
			size="25" 
			maxlength="50" 
			required="true" 
			message="Please enter a desired username!"/>
	<br />
</td>

<td width="20%" valign="top">
	<p>Password:</p>
</td>

<td width="25%" valign="top">
	  	<cfinput name="password_pass" 
			type="text" 
			value="" 
			size="25" 
			maxlength="25" 
			required="true" 
			message="Please enter a valid password!"/>
<br />
</td>
</tr>

<tr>
	
<td width="20%" valign="top">
<p>Email address:</p>
</td>

<td width="25%">
    		<cfinput name="EMAIL" 
			type="text" 
			value="" 
			size="25" 
			maxlength="200" 
			required="true" 
			message="Please enter your email address!"/></td>
</p>
</td>
	
</tr>
</table>

<p>
Browse for your display image you’d like on your personal page: <br />
	  <cfinput name="ul_path" 
			type="file" 
			id="ul_path" 
			size="30"
			required="false">
	  <cfinput type="submit" name="upload_now" value="submit">
</p>
</cfform>

<cfif isdefined("form.register_now")>
	<!--- ie 150KB.  1024 bytes == 1KB --->
	<cfset maxFileSize = (150 * 1024)>

	<cffile action="upload" filefield="ul_path" destination="#ExpandPath("/upload")#" accept="image/jpeg, image/gif, image/jpg, image/svg, image/pjpeg, image/pjpg, image/png, image/x-png" nameconflict="makeunique">
	<cfif CFFILE.fileSize LTE maxFileSize>
	  
	  <CFQUERY DATASOURCE="mydatabase" NAME="REGISTER">
	    INSERT INTO REGISTER(USER_NAME, SERVER_FILE_NAME, CLIENT_FILE_NAME, PASSWORD_PASS, EMAIL_ADDRESS)
	    VALUES
	    ( 
	    <cfqueryparam value="#form.username_name#" cfsqltype="cf_sql_varchar">
	    , 
	    <cfqueryparam value="#form.password_pass#" cfsqltype="cf_sql_varchar">
	    , 
	    <cfqueryparam value="#CFFILE.serverFile#" cfsqltype="cf_sql_varchar">
	    , 
	    <cfqueryparam value="#CFFILE.clientFile#" cfsqltype="cf_sql_varchar">
	    ,
	    <cfqueryparam value="#form.EMAIL#" cfsqltype="cf_sql_varchar">
	    )
      </CFQUERY>
    </cfif>
	<cfif CFFILE.fileSize LTE maxFileSize><p>
    Your file was successfully uploaded!  Thank you!    
   </p>
<cfelse>
   
   <!--- Message if one of the criteria above was not met--->
   Sorry your file is too big! 
    
    <cffile action="delete" 
            file="#CFFILE.serverDirectory#\#CFFILE.serverFile#">
	</cfif>
</cfif>

Code (markup):

This should allow them to create a username and password (both required) and include an email address (required). They also have the option to upload a personal image, which I haven't learned how to use yet.

Questions:

1. Do you have something similar to this? Do you have any sort of validation (where they need to type in the pictured code like "Y7q2E" all weird looking...)?

2. Do you incorporate an automatic email to the user's email address to "activate" his/her account?

3. What do you do when people forget their usernames and/or passwords?


I also need similar help with this for the login_process page.

 

Great Questions,

I do have something similar but For some reason I have yet to figure out I cant get the <cfform> tag to work on my shared hosting server. I think they are having a problem.

As far as the email confirmation, this is a good idea. I haven't done it yet but this seems like a good time to get one done.

You could try this stuff in red, you will also need a new page for confirmation to take place. like confirmation.cfm. then you send a link to their email they can click to get to the confirmation.cfm page where you will confirm the email...

Also add two more columns to the table called "confirm_id" and "confirmed"
confirm_ID can be a varchar data type or number or text, and confirmed should be a boolean or bit type. ( a 1 or a 0)

<!--- Sets a variable to define the maximum file size allowed for an individual photo--->

<cfset maxFileSize = (150 * 1024)>
<cfform action="register.cfm" method="post" name="register_form" enctype="multipart/form-data" id="register_form">

[COLOR="red"]<cfinput type="hidden" name="confirm_ID" value="#createuuid()#">
<cfinput type="hidden" name="confirmed" value="0">
[/COLOR]

<table width="95%">		
<tr>

<td width="20%" valign="top">
	<p>Desired username:
</td>

<td width="25%" valign="top">
	  	<cfinput name="username_name" 
			type="text" 
			value="" 
			size="25" 
			maxlength="50" 
			required="true" 
			message="Please enter a desired username!"/>
	<br />
</td>

<td width="20%" valign="top">
	<p>Password:</p>
</td>

<td width="25%" valign="top">
	  	<cfinput name="password_pass" 
			[COLOR="Red"]Change this "type" to password
                                      type="password"[/COLOR] 
			value="" 
			size="25" 
			maxlength="25" 
			required="true" 
			message="Please enter a valid password!"/>
<br />
</td>
</tr>

<tr>
	
<td width="20%" valign="top">
<p>Email address:</p>
</td>

<td width="25%">
    		<cfinput name="EMAIL" 
			type="text" 
			value="" 
			size="25" 
			maxlength="200" 
			required="true" 
			message="Please enter your email address!"/></td>
</p>
</td>
	
</tr>
</table>

<p>
Browse for your display image you’d like on your personal page: <br />
	  <cfinput name="ul_path" 
			type="file" 
			id="ul_path" 
			size="30"
			required="false">
	  <cfinput type="submit" name="upload_now" value="submit">
</p>
</cfform>

<cfif isdefined("form.register_now")>
	<!--- ie 150KB.  1024 bytes == 1KB --->
	<cfset maxFileSize = (150 * 1024)>

	<cffile action="upload" filefield="ul_path" destination="#ExpandPath("/upload")#" accept="image/jpeg, image/gif, image/jpg, image/svg, image/pjpeg, image/pjpg, image/png, image/x-png" nameconflict="makeunique">
	<cfif CFFILE.fileSize LTE maxFileSize>
	  
	  <CFQUERY DATASOURCE="mydatabase" NAME="REGISTER">
	    INSERT INTO REGISTER(USER_NAME, SERVER_FILE_NAME, CLIENT_FILE_NAME, PASSWORD_PASS, EMAIL_ADDRESS[COLOR="red"], CONFIRM_ID, CONFIRMED [/COLOR])
	    VALUES
	    ( 
	    <cfqueryparam value="#form.username_name#" cfsqltype="cf_sql_varchar">
	    , 
	    <cfqueryparam value="#form.password_pass#" cfsqltype="cf_sql_varchar">
	    , 
	    <cfqueryparam value="#CFFILE.serverFile#" cfsqltype="cf_sql_varchar">
	    , 
	    <cfqueryparam value="#CFFILE.clientFile#" cfsqltype="cf_sql_varchar">
	    ,
	    <cfqueryparam value="#form.EMAIL#" cfsqltype="cf_sql_varchar">[COLOR="red"]
                ,
        <cfqueryparam value="#form.confirm_ID#" cfsqltype="cf_sql_varchar">
                ,
        <cfqueryparam value="#form.confirmed#" cfsqltype="cf_sql_bit">[/COLOR]
	    )
      </CFQUERY>

[COLOR="Red"]<cfmail to="#form.email#" from="youremail" subject="email confirmation">

Click this link to confirm your email:

<a href="http://www.yourwebsite.com/confirmation.cfm?confirmID=<cfoutput>#form.confirm_id#</cfouput>">Confirm your Email!</a>

</cfmail>



[/COLOR]


    </cfif>
	<cfif CFFILE.fileSize LTE maxFileSize><p>
    Your file was successfully uploaded!  Thank you!    
   </p>
<cfelse>
   
   <!--- Message if one of the criteria above was not met--->
   Sorry your file is too big! 
    
    <cffile action="delete" 
            file="#CFFILE.serverDirectory#\#CFFILE.serverFile#">
	</cfif>
</cfif>

Code (markup):

Then if Their email is correct then they should get the link and click it to get back to the confirmation.cfm page.

Here what the confirmation page may look like.


Also... Be sure to really check all the spellings because I'm writing all this stuff right here on the spot...

confirmation.cfm

<cfqurey datasource="#youR dns# name="checkid">
SELECT CONFIRM_ID, CONFIRMED
FROM REGISTER
WHERE CONFIRM_ID = '#URL.CONFIRMID#' AND CONFIRMED = '0'
</cfquery>


<cfif checkid.recordcount eq 1>

<cfquery datasource="" name="confirmemail">
UPDATE REGISTER
SET CONFIRMED = '1'
WHERE CONFIRM_ID = '#URL.CONFIRMID#' AND CONFIRMED = '0'
</cfquery>

<cfelse>

<cflocation url="index.cfm">

</cfif>

Code (markup):

So if they click the link it should check to see if they have registered and if so it should update the confirmed column to a 1 meaning that their email is confirmed.

What if who ever found this page by accident then
I sent them back to the home page. because no one needs to be here if they arnt confirming there email.

 

If they forgot their password you can do omthing like this:

It mostly there. Just ask if you get stuck, You can change all the inputs fields to cfinput if you like. It will be easier to handel the validation if you do.

I do all my validation with a <cfif> statment because I cant get the cfform & cfinput tags to work on my shared server.

A simple form,

<form action="whatever.cfm" method="post">
        <p>Firstname</p>
        <input type="text" name="firstname" value="" />
        <p>Lastname</p>
        <input type="text" name="lastname" value="" />
        <p>LoginId</p>
        <input type="text" name="loginid" value="" />
        <p>Email</p>
        <input type="text" name="email" value="" />
        <br />
        <input type="submit" name="Go" value="Go" />
        </form>    

Code (markup):

Then the action page:

<cfquery datasource="#datasource#" name="retpass">
SELECT PASSWORD
FROM REGISTER
WHERE FIRSTNAME = '#FORM.FIRSTNAME#' AND
      LASTNAME = '#FORM.LASTNAME#' AND
      LOGINID = '#FORM.LOGINID#' AND
      EMAIL = '#FORM.EMAIL#'
</cfquery>

<cfif retpass.recordcount eq 1>

<cfmail to="#form.email#" from="youremail" subject="Your password" type="text/html">

<p>Thank you for being apart of 
 <a href="http://www.yoursite.com" title="whatever">www.yoursite.com</a>  
 a new recipie community</p>

<p>Here is the information you requested!</p><br><br>

<cfoutput>#retpass.user_password#</cfoutput><br><br>

It has been our pleasure helping you today! Please tell your friends about us!<br><br>

<a href="http://www.yoursite.com" title="Recipie.com">Your Site name</a>
</cfmail>

<p>Thank you, the information you have requested has been sent to your email!</p>
<br><br>

If we can further assist you in any way please <a href="contactme.cfm" title="Contact Site Developer">Contact Us</a>.<br><br>
<a href="index.cfm" title="">Home</a>
<cfelse>

Sorry your Information does not appear to be in our records. If you feel we have made a mistake please <a href="contactme.cfm" title="Contact Site Developer">Contact Us</a> right away so we can get you logged in.<br><br>

<a href="javascript:history.go(-1)"><img src="images/retun.gif" border="0"></a>

</cfif></CFIF>

Code (markup):

 

Thanks! A few questions on your posts:

i'm not really sure what the red part above is doing. What is the URL. for?


One other question:

This may be more of a validation comment... but wouldn't you rather have the password sent to the email address you have in your database for the user? I mean, here, with this code, someone could guess another user's information, place their own email in the form, and you'd mistakenly send the deviant the correct password! Of course, this is contingent on the fact that there are a**holes out there...

Thanks for the info. I will be updating and testing. I will let you know my progress.

 

Good question,

This part in red is checking to see if the person regitered on your site and if so does the url variable match whats stored in their record.

If this is true then it will update the "CONFIRMED" column to a 1. Meaning that this user has confirmed their email is valid.

The reason for the URL.CONFIRMID is because i "scoped" the variable.

So instead of just

WHERE CONFIRM_ID = '#CONFIRMID#' AND CONFIRMED = '0'

Code (markup):

You tell CF where to look for the variable. This variable comes from the url.
So it looks like this:

WHERE CONFIRM_ID = '#URL.CONFIRMID#' AND CONFIRMED = '0'

Code (markup):

You could do the same with the second part of the where statement too, so instead of what you see above you would write it like this

WHERE CONFIRM_ID = '#URL.CONFIRMID#' AND CHECKID.CONFIRMED = '0'

Code (markup):

Now cf knows to look at the query "checkid" for the variable "confirmed"

CfStralight recommends you scope all you variables all the time. I think it is a good idea both for making it easier to debug because it tells you where does that variable come from and it makes your scripts more solid with less ambiguous variables.


Second question:

This script wont even email the user unless the have entered the correct FIRSTNAME, LASTNAME, LOGINID, AND EMAIL.

So if one of those pieces of info don't match whats in the database then it wont send them the password.

If someone entered then wrong email then it will tell them sorry you have entered a wrong email.

But feel free to tweak this a bit if u think it is too much or maybe needs some more security. I'm open to suggestions because I don't think I'm totally happy with it either.

 

You also asked about a captcha

Here one that is made to be used with CF

http://lyla.maestropublishing.com/


And here another article about how to adjust it if needed

http://www.carehart.org/blog/client/index.cfm/2006/8/17/the_angst_against_captchas

 

From a couple posts ago, you mentioned the following code:

<cfinput type="hidden" name="confirm_ID" value[COLOR="Red"]="#createuuid()#">[/COLOR]
<cfinput type="hidden" name="confirmed" value="0">

Code (markup):

I'm getting an error, and it seems that it does not like the portion in red above. Is this syntax specific for your mySQL database? I am using Access... i'm wondering if access does not know how to interpret this when I insert the data into the database with my query.

 

Also, how can I ensure someone doesn't try to register a username that has already been taken?

I'm thinking I could write a simple IF statement... to check IF the username exists in the database table, and if so, return a string like "Sorry, username is taken, please try another name".

 

Try to wrap the part in red in cfoutput tags like this

<cfinput type="hidden" name="confirm_ID" value="[COLOR="Red"]<cfoutput>#createuuid()#</cfoutput>[/COLOR]">
<cfinput type="hidden" name="confirmed" value="0">

Code (markup):

For the username check you can add this to the action page

<cfquery datasource="" name"check">
SELECT USERNAME
FROM "YOUR TABLE NAME"
WHERE USERNAME = '#FORM.USERNAME#'
</cfquery>

<cfif check.recordcount eq 1>
 Sorry that name is taken
<cfelse>
 The rest of the action page
</cfif>

Code (markup):

This will get you started but I think it needs some help,

Maybe CfStarlight can help this one out. I would like to implement this on my site as well but I just havent figured out a better way to do this yet.

 

<cfinput type="hidden" name="confirm_ID" value="<cfoutput>#createuuid()#</cfoutput>">
<cfinput type="hidden" name="confirmed" value="0">

Code (markup):

Yeah unfortunately, when I try this, I receive the same error.

I think I may remove this CONFIRM_ID field anyway, since I already have a record ID generated in my database for each registrant. I can use this ID when checking if one is confirmed or not.

 

Thats a good Idea, I dont use it either. I just send their userid to their email. The reason for creating a unique id for the email confirmation is so that it is completely unique to that registration and nothing else.

Just for S & G, what error are you getting. It it telling you "syntax error near the word..." or somthing like that.

If so you probly just need to add a set of single qoutes around the 'CONFIRM_ID' in the sql stament inside you insert query under values.

Like this

<Cfquery....
INSERT INTO...
VALUES ('#CONFIRM_ID#')

Code (markup):

 

It was a more general error than that. I believe it was "error executing database query"

 

Along a similar topic...

I have my form insert the data into my database as such:

	    <CFQUERY DATASOURCE="mydatabase" NAME="TBLUSER">
	      INSERT INTO TBLUSER(USER_NAME_NAME, USER_PASS_PASS, SERVER_FILE_NAME, CLIENT_FILE_NAME, EMAIL, CONFIRMED, USER_FIRST_NAME, USER_LAST_NAME, USER_GENDER, USER_FAV_RECIPE)
	      VALUES
	      ( 
	      <cfqueryparam value="#form.USER_NAME_NAME#" cfsqltype="cf_sql_varchar">
	      , 

	      <cfqueryparam value="#form.USER_PASS_PASS#" cfsqltype="cf_sql_varchar">
	      , 
	      <cfqueryparam value="#serverFileName#" cfsqltype="cf_sql_varchar">
	      , 
	      <cfqueryparam value="#clientFileName#" cfsqltype="cf_sql_varchar">
	      ,
	      <cfqueryparam value="#form.EMAIL#" cfsqltype="cf_sql_varchar">
	      , 
	      <cfqueryparam value="#form.CONFIRMED#" cfsqltype="cf_sql_varchar">
	      , 
	      <cfqueryparam value="#form.USER_FIRST_NAME#" cfsqltype="cf_sql_varchar">
	      ,
	      <cfqueryparam value="#form.USER_LAST_NAME#" cfsqltype="cf_sql_varchar">
	      , 
	      <cfqueryparam value="#form.USER_GENDER#" cfsqltype="cf_sql_varchar">
	      , 
	      <cfqueryparam value="#form.USER_FAV_RECIPE#" cfsqltype="cf_sql_varchar">
	      )
        </CFQUERY>

Code (markup):

You mentioned before about tracking "User's last login date/time". How could I incorporate this into the query, as it'd require the UPDATE syntax and not INSERT?

 

Just create another "hidden" field in your form, call it last_login and give it a value of

#now()#

Code (markup):

Then for the insert query you need to add another cfqueryparm to put this data into the database, Dont forget to create a new column as well called last_login


Now on the login action page you will have your update query.

cfquery....

Update yourtable
set last_login = '#now()#'
where userid = '#form.userid#'

Code (markup):

I used userid as the variable name because I dont know what you call it. you may have to change this one.


Put this query after the part where you check the loginid and password. That way we can make sure a valid user has logged in and that you update the correct record.

 

<cfmail to="#form.email#" from="youremail" subject="Your password" type="text/html"> 

Code (markup):

I tried implementing this, but I encountered the following error:

So, I would like to include the server= attribute, but do not know how to configure it for my website (Forta's book only describes it for localhost).

 

Did this happen on your local machine or did it happen on your shared hosting server?

If it happened on you hosting server then you will need to contact them to setup the SMTP.

I don't have SMTP configured on my local machine either.

 

OK... i will try uploading to my server for testing. I'm sure that's the case then.

Another question that's driving me crazy now... I have my login form as such:

  <h1>Login</h1>
  <p>Please login below:</p>
<cfform method="post" action="login.cfm">
<table width="60%" align="left" cellpadding="0" border="0">
<tr>
	<td>
	  <p>Username:
	    </p></td>
	<td>
			  <cfinput name="USER_NAME_NAME" 
					type="text" 
					value="" 
					size="25" 
					maxlength="50" 
					required="true" 
					message="Please enter your username!"/>
	</td>
</tr>
<tr>
	<td>
	  <p>Password: 	
	    </p></td>
<td>
				<cfinput name="USER_PASS_PASS" 
					type="text" 
					value="" 
					size="25" 
					maxlength="25" 
					required="true" 
					message="Please enter a valid password!"/>
</td>
</tr>
<tr>
<cfinput type="submit" name="submit">
</tr>
</table>
</cfform>
<cfquery datasource="mydatabase" name="user_check">
SELECT USER_NAME_NAME, USER_PASS_PASS
FROM TBLUSER
WHERE USER_NAME_NAME = '#form.USER_NAME_NAME#' AND USER_PASS_PASS = '#form.USER_PASS_PASS#'
</cfquery>

<cfif user_check.recordcount eq 1>
  <p>
    <cfset session.userid = #form.username_name#>
    
    <br />Thank you for logging in!  Please click <a href="javascript:history.go(-1)">here</a> to return browsing!
    
  <cfelse>
  <cflocation url="login.cfm">
    
  </p>
</cfif>

Code (markup):

I am getting the following error:

I'm sure it's something simple, but I can't figure out what it is. I have my registration page similar to this, with no problem. Maybe I just need a second pair of eyes to check over it. Any thoughts?

 

If the SELECT statment in on the same page as the form you may need to add a cfif statment before the SELECT statment.


Like this

[COLOR="Red"]<cfif IsDefined("FORM.USER_NAME_NAME")>[/COLOR]
<cfquery datasource="mydatabase" name="user_check">
SELECT USER_NAME_NAME, USER_PASS_PASS
FROM TBLUSER
WHERE USER_NAME_NAME = '#form.USER_NAME_NAME#' AND USER_PASS_PASS = '#form.USER_PASS_PASS#'
</cfquery>

<cfif user_check.recordcount eq 1>
  <p>
    <cfset session.userid = #form.username_name#>
    
    <br />Thank you for logging in!  Please click <a href="javascript:history.go(-1)">here</a> to return browsing!
    
  <cfelse>
  <cflocation url="login.cfm">
    
  </p>
</cfif>
[COLOR="red"]</cfif>[/COLOR]

Code (markup):

 

Great. That eliminated the error! But when I test my login, nothing happens.

Here is my login.cfm code:

  <h1>Login</h1>
  <p>Please login below:</p>
<form method="post" action="login.cfm">
<table width="60%" align="left" cellpadding="0" border="0">
<tr>
	<td>
	  <p>Username:
	    </p></td>
	<td>
 	<input type="text" name="username_name">
	</td>
</tr>
<tr>
	<td>
	  <p>Password: 	
	    </p></td>
<td>
<input type="text" name="password_pass">
</td>
</tr>
<tr>
<input type="submit">
</tr>
</table>
</form>
<cfif IsDefined("FORM.USER_NAME_NAME")>
<cfquery datasource="mydatabase" name="user_check">
SELECT USER_NAME_NAME, USER_PASS_PASS
FROM TBLUSER
WHERE USER_NAME_NAME = '#FORM.username_name#' AND USER_PASS_PASS = '#FORM.password_pass#'
</cfquery>

<cfif user_check.recordcount eq 1>
  <p>
    <cfset session.userid = #form.username_name#>
    
    <br />Thank you for logging in!  Please click <a href="javascript:history.go(-1)">here</a> to return browsing!
    
  <cfelse>
  <cflocation url="index.cfm">
    
  </p>
</cfif>
</cfif>

Code (markup):

When i deliberately type in a non-existent username and password, it just refreshes the login.cfm, instead of directly me to index.cfm.

When I deliberately type in an existing username and password, the same thing happens - nothing.

Here is my application.cfc as well... i'm not sure if this also may be causing a problem.

<cfcomponent output="no"> 

         <cfset this.sessionmanagement="yes"> 
         <cfset this.sessiontimeout=CreateTimeSpan(0,0,5,30)>
	     
	<cferror type="exception" mailto="webmaster@mywebsite.com" template="errorexception.cfm">
	<cferror type="Request" mailto="webmaster@mywebsite.com" template="ErrorRequest.cfm">


    <cffunction name="onApplicationStart">
  
	</cffunction>


    <cffunction name="OnSessionStart" returntype="void">
    
    </cffunction>

<cffunction name="OnRequestStart">
	 	<cfargument type="String" name="index" required="true"/>	

         <cfset application.dataSource = "mydatabase">
         <cfset dbdsn = "mydatabase"> 
		 
        <cfreturn true>
</cffunction>

     <cffunction name="onSessionEnd">
  	<cfargument name="sessionScope" type="struct" required="true">
    <cfargument name="appScope" type="struct" required="false">
      
	<cfset var last_login = "">

	<!--- if this is a logged in user, record their log out --->	
	<cfif structKeyExists(arguments.sessionScope, "userID")>
		
			<cfquery datasource="mydatabase" name="last_login">
				UPDATE 	USER_NAME_NAME
				SET 	LAST_LOGIN_DATE = #CreateODBCDateTime(NOW())#,
   						ONLINE = '0' 
	    		WHERE 	USER_NAME_NAME = '#arguments.SessionScope.USER_NAME_NAME#'
				AND		ONLINE = '1'
			</cfquery>

	</cfif>
</cffunction>
</cfcomponent>

Code (markup):