Applies to: Microsoft FrontPage 2000, Microsoft Access 2000, IIS 5.0
Operating System: Microsoft Windows 2000 Professional
I am trying to protect a portion of a web site by allowing users to =
register a username and password & then login with those details, but so =
far I am having only marginal success. I am far from an expert on ASP =
programming, indeed the code I am using comes from "Sams Teach Yourself =
E-Commerce Programming with ASP" but it is ideally suited for my =
purpose.
In short, there are 3 .asp pages (register.asp, login.asp & =
checkpassword.asp - the code for each is below), a global.asa file was =
automatically created and by following the instructions in the book, I =
also created a small Access database called UserDB.mdb, which stores the =
username & password of each user when they register & also verify's =
those details when the user attempts to login again.
The DNS connection has been setup within FrontPage and I have verified =
that this connection works by clicking "Tools", "Web Settings" & the =
"Database" tab, highlighting the DNS connection & clicking Verify.=20
The problems seem to occur when I try to register a new username & =
password, for some strange reason the details I enter are not being =
saved in the database table, and to compound the problem further, if I =
register just a username, or a password but not both, the page simply =
refreshes itself with empty boxes instead of giving an error message to =
indicate that a "username" or "password" must be entered, which if I =
have read the code correctly on the "checkpassword.asp" page, should =
happen.
To further confuse the situation, if I manually enter a username & =
password into the database table and then attempt to click a hyperlink =
taking me to a "test.asp" page, with the INCLUDE FILE: <!-- #INCLUDE =
FILE=3D"checkpassword.asp" -->, I am automatically taken to the =
login.asp, where if I enter the username & password that I manually put =
into the database table, it takes me to the selected "Protected" web =
page. In my mind that clearly shows the DNS connection is working but =
yet it won't store new registered details into the database table, which =
is extremely confusing.
If anyone can see what I may be doing wrong, or point me in the right =
direction, your help & advice will be greatly appreciated. As I pointed =
out earlier I am far from an expert, so any help you can give would be =
ideally suited towards a newbie mentality.
Below is the code for the three .asp pages:
Many thanks in advance
Wayne Smith
register.asp
<%
nextPage =3D Request( "nextPage" )
newUsername =3D Request( "newUsername" )
newPassword =3D Request( "newPassword" )
%>
<HTML>
<HEAD><TITLE>Register"</TITLE></HEAD>
<BODY>
Register at this Web site by selecting a username and password:
<FORM METHOD=3D"post" ACTION=3D"<%=3DnextPage%>">
<INPUT NAME=3D"newUser" TYPE=3D"hidden" VALUE=3D"1">
<P><B>USERNAME:</B>
<INPUT NAME=3D"newUsername" SIZE=3D20 MAXLENGTH=3D"20"=20
VALUE=3D"<%=3DServer.HTMLEncode( newUsername )%>">
<P><B>PASSWORD:</B>
<INPUT NAME=3D"newPassword" SIZE=3D20 MAXLENGTH=3D"20"=20
VALUE=3D"<%=3DServer.HTMLEncode( newPassword )%>">
<P><INPUT TYPE=3D"submit" VALUE=3D"Register!">
</FORM>
</BODY>
</HTML>
-------------------------------------------------------------------------=
---------
login.asp
<HTML>
<HEAD><TITLE>Login</TITLE></HEAD>
<BODY>
<%=3DloginMessage%>
<FORM METHOD=3D"post" ACTION=3D"<%=3DnextPage%>">
<P><B>USERNAME:</B>
<INPUT NAME=3D"username" SIZE=3D20 MAXLENGTH=3D"20"=20
VALUE=3D"<%=3DServer.HTMLEncode( username )%>">
<P><B>PASSWORD:</B>
<INPUT NAME=3D"password" SIZE=3D20 MAXLENGTH=3D"20"=20
VALUE=3D"<%=3DServer.HTMLEncode( password )%>">
<p><INPUT NAME=3D"addCookie" TYPE=3D"Checkbox" VALUE=3D"1"> Remember me =
with a cookie
<P><INPUT TYPE=3D"submit" VALUE=3D"Login">
</FORM>
<p>
<a href=3D"register.asp?nextpage=3D<%Server.URLEncode( nextpage )%>">
Click here to register</a>
</BODY>
</HTML>
-------------------------------------------------------------
checkpassword.asp
<%
CONST useSession =3D TRUE
' Retrieve Form Variables
username =3D TRIM( Request( "username" ) )
password =3D TRIM( Request( "password" ) )
newUser =3D TRIM( Request( "newUser" ) )
newUsername =3D TRIM( Request( "newUsername" ) )
newPassword =3D TRIM( Request( "newPassword" ) )
addCookie =3D TRIM( Request( "addCookie" ) )
' Retrieve Current Page
nextPage =3D Request.ServerVariables( "SCRIPT_NAME" )
' Ready Database Connection
Set Con =3D Server.CreateObject( "ADODB.Connection" )
Con.Open "userDNS"
' Add New User
IF newUser <> "" THEN
IF newUsername =3D "" THEN
showError "You must enter a username"
END IF
IF newPassword =3D "" THEN
showError "You must enter a password"
END IF
IF usernameTaken( newUsername ) THEN
showError "The username you entered has already " &_
"been chosen by a previous user. Please select " &_
"a new username"
END IF
sqlString =3D "INSERT INTO userlist ( user_username, user_password ) " =
&_
"VALUES ('" & newUsername & "','" & newPassword & "')"
Con.Execute sqlString
username =3D newUsername
password =3D newPassword
IF useSession THEN Session( "loggedIn" ) =3D "Yes"
END IF
' Authenticate User
IF Session( "loggedIn" ) =3D "" THEN=20
IF username =3D "" OR password =3D "" THEN
loginMessage =3D "You must login before you can view this page."
showLogin
END IF
result =3D validateLogin( username, password )
IF result =3D 1 THEN
loginMessage =3D "You entered an unregistered username."
showLogin
END IF
IF result =3D 2 THEN
loginMessage =3D "You did not enter a valid password."
showLogin
END IF
IF useSession THEN Session( "loggedIn" ) =3D "Yes"
END IF
' Add a Cookie
IF addCookie <> "" THEN
Response.Cookies( "username" ) =3D username
Response.Cookies( "username" ).Expires =3D "12/25/2037"
Response.Cookies( "password" ) =3D password
Response.Cookies( "password" ).Expires =3D "12/25/2037"
END IF
' Create Security Query String Variable
sq =3D "username=3D" & Server.HTMLEncode( username ) & "&"
sq =3D sq & "password=3D" & Server.HTMLEncode( password )=20
' Create Security Form Variable
sf =3D "<input name=3D""username"" type=3D""hidden"" "
sf =3D sf & "value=3D""" & Server.HTMLEncode( username ) & """>"
sf =3D sf & "<input name=3D""password"" type=3D""hidden"" "
sf =3D sf & "value=3D""" & Server.HTMLEncode( password ) & """>"
' Check Username and Password
FUNCTION validateLogin( theUsername, thePassword )
sqlString =3D "SELECT user_password FROM userlist " &_
"WHERE user_username=3D'" & fixQuotes( username ) & "'"=20
Set RS =3D Con.Execute( sqlString )
IF RS.EOF THEN
validateLogin =3D 1
ELSE