pasword protection

Hello
Can somebody help me with some asp code? I want a popup screen when a link is clicked so the
user has to fill in his username and pasword. When both username and pasword are correct, the person
will be redirected to the correct (asp) page, otherwise the message will be : "no correct username
and pw!". I suppose the usernames and paswords have to be put in a access database?

thank for your help.

 

yes, you could store the usernames/passwords in a database - i myself don't use access and i'm sure you'll get alot of people who will tell you to stay away from access entirely - but i suppose it comes down to availability. if you had the option - use something like mysql.

the easiest way to do this is to submit the username/password form fields to the page where you plan to show the "members only" stuff, and put a query that checks to see if the username/password combo supplied matches anything in the database. you could then create an if/then statement that would show "no correct username and pw!" or whatever your error message would be in the event that there are no matches to the username/password combo, else show the rest of the page.

i.e.

if yourrecordset.eof and yourrecordset.bof then

response.write "no correct username and pw!"

else

'show your members-only stuff here

end if

 

I would do it like this (and have done it like this many times):

1. Create a login page (I would avoid popup if possilbe). Submit this to a loginprocess page. Have a hidden control on the login form that reads the servervariables collection indicating where the page request came from. It's something like URL_REQUEST, i can't remember but you can look it up.

2. Add code to the loginprocess page to check the database to see if the username/password matches. When it does match set a session variable indicating the name of the logged in user. Additionally add some code with a response.redirect to push the user to the place they wanted to get to in the first place by looking at the hidden form control you created above.

3. Create a small include file that checks for the value in the session variable, if it's empty then redirect to the login page, if not then assume the user is logged in.

4. Add the include to the top of every page you want to control access to.

I could code something up for you if you needed it (for a fee of course ).

Jay

 

be sure to cleanse your input variables. SQL injection can be TRES nasty if you're using a database to do your authentication.

you can really easily cleanse your variables by doubling the single quotes with a replace statement. i.e.

newusername = replace(request.form("username"), "'", "''")

the variable "newusername" is now cleansed of nasty little grubby hacking nOOb's meddling and ready to pass to your authentication query.