username and password validation

[Eugene Anthony]

Is this method of validation for password and username considered to be
secured. In my previous post I was given a solution that uses command
object and the values are parsed by parameters. But the solution only
worked well for insert and delete, but not select.

<%
if Request.QuerySt ring("Action") = 1 then
username = Trim(request.fo rm("username") )
password = Trim(request.fo rm("password") )
if username <> "" and password <> "" then
set conn = server.CreateOb ject("ADODB.Con nection")
conn.connection string = "Provider=Micro soft.Jet.OLEDB. 4.0;Data
Source=" & Server.MapPath( "/db/upload/stelladb.mdb") & ";"
conn.open
set rs = server.CreateOb ject("ADODB.Rec ordset")
sql = "SELECT Count(*) FROM Account WHERE username='" &
username & "' AND password='" & password & "'"
rs.open sql,conn,3,3
if rs.Fields(0) = 1 then
session("boolea n") = "true"
response.redire ct "main.asp"
else
session("boolea n") = "false"
response.write "<center><f ont class='error'>E rror: Invalid
Authentication</font></center><br><br> "
end if
conn.close
Set conn = nothing
end if
end if
%>

Eugene Anthony

*** Sent via Developersdex http://www.developersdex.com ***

[sashi]

Hi guys,

the scripts seems to be ok with me.. it needs a little tidy up.. i guess.. well.. my suggestions will be as below;

1.) protect the .mdb file with a password
2.) set the session.timeout value - incase of idle session
3.) encrypt user password


below is the my script.. check it out..
'//--- inc_connection ---
<%
DIM ObjCon
Set ObjCon = Server.CreateOb ject("ADODB.Con nection")
ObjCon.Open ("Provider=Micr osoft.Jet.OLEDB .4.0;Persist Security Info=False;Jet OLEDB:Database Password=xyz;Da ta Source=" & Server.MapPath( "../db/eduguide.mdb"))
%>

'//--- inc_authenticat e.asp ---
<%@ LANGUAGE="VBSCR IPT" %>
<!--#INCLUDE FILE="inc_conne ction.asp" -->
<!--#INCLUDE FILE="inc_encry ption.asp" -->
<%
Dim myAccountNo, Message, Action,ID,UID,P WD,ACL,EMAILID, nNewsID, nNewsSummary
myAccountNo = Session("myAcco untNo")
Message = Session("Messag e")
Session("Messag e") = ""
Action = Session("Action ")
ID = Session("ID")
UID = Session("UID")
PWD = Session("PWD")
ACL = Session("ACL")
EMAILID = Session("EMAILI D")
%>
<%
dim URL_Link
dim myname, mypassword
dim cnpath, sSQL, TMPSQL
dim objRS, objUpdateRec
myname=request. form("txtUserna me")
mypassword=requ est.form("txtPa ssword")
URL_Link = Request.ServerV ariables("HTTP_ REFERER")
if myname = "Username" or myname = "" then
Session("Messag e") = "Check username"
Response.Redire ct URL_Link
elseif mypassword = "Password" or mypassword= "" then
Session("Messag e") = "Check password"
Response.Redire ct URL_Link
end if
sSQL ="SELECT * FROM sSECURITYTBL WHERE USERNAME='"
sSQL = sSQL & myname & "'"
set objRS=objCon.ex ecute(sSQL)
If objRS.EOF then
objRS.close
objCon.close
set objRS=nothing
set objCon=nothing
Session("Messag e") = "Invalid username"
'Response.Redir ect URL_Link"?error =" & Server.URLEncod e(Message)
Response.Redire ct URL_Link
end if
If objRS("password ")= pEncrypt(mypass word) then
'The default value is 10 minutes
Session.Timeout = 10
If Request.Form("c hkRememberMe") = "True" Then
Response.Cookie s("Username") = Request.Form("t xtUsername")
Response.Cookie s("Username").E xpires = DateAdd("m", 1, Now())
Response.Cookie s("Password") = Request.Form("t xtPassword")
Response.Cookie s("Password").E xpires = DateAdd("m", 1, Now())
end if
If Request.Form("c hkRememberMe") = "" Then
Response.Cookie s("Username") = ""
Response.Cookie s("Username").E xpires = DateAdd("m", -3, Now())
Response.Cookie s("Password") = ""
Response.Cookie s("Password").E xpires = DateAdd("m", -3, Now())
end if
'If they made it here, they logged in successfully,
'so set the value of the LoggedIn session variables
Session("Logged In") = "yes"
'Reroute users to appropriate page based on their access level
if objRS("accessle vel")="administ rator" then
Session("isAdmi nLogin") = "yes"
Session("Action ")= "main"
Session("ID") = objRS("ID")
Session("UID")= objRS("Username ")
Session("PWD")= objRS("Password ")
Session("ACL")= objRS("AccessLe vel")
Session("EMAILI D")=objRS("Emai l")
Response.redire ct "../admin/default.asp"
elseif objRS("accessle vel")="educator " then
Session("Action ")= "main"
Session("myAcco untNo") = objRS("vAccount _No")
Session("ID") = objRS("ID")
Session("UID")= objRS("Username ")
Session("PWD")= objRS("Password ")
Session("ACL")= objRS("AccessLe vel")
Session("EMAILI D")=objRS("Emai l")
Response.redire ct "../admin/educator/default.asp"
elseif objRS("accessle vel")="supplier " then
Session("Action ")= "main"
Session("myAcco untNo") = objRS("vAccount _No")
Session("ID") = objRS("ID")
Session("UID")= objRS("Username ")
Session("PWD")= objRS("Password ")
Session("ACL")= objRS("AccessLe vel")
Session("EMAILI D")=objRS("Emai l")
Response.redire ct "../admin/supplier/default.asp"
end if
objRS.Close
objCon.Close
set objRS=nothing
set objCon=nothing
else
objRS.Close
objCon.Close
set objRS=nothing
set objCon=nothing
Session("Messag e") = "Invalid password"
'Response.Redir ect URL_Link"?error =" & Server.URLEncod e(Message)
Response.Redire ct URL_Link
end if
%>

[Justin Piper]

On Sat, 17 Jun 2006 03:13:17 -0500, Mike Brind <pa*******@hotm ail.com>
wrote:

8. Once working and ready for deployment, remove Option Explicit
statement

I've never heard such advice. What do you gain by doing this?

--
Justin Piper
Bizco Technologies
http://www.bizco.com/

[Dave Anderson]

Justin Piper wrote:

8. Once working and ready for deployment, remove Option
Explicit statement

I've never heard such advice. What do you gain by doing this?

A few CPU cycles. And probably a bad habit.

As Eric Lippert has written[1], VBScript performance is vastly improved when
variables are explicitly declared. I have seen suggestions[2] that removing
Option Explicit from your code eliminates one parsing step during script
execution and does not harm performance as long as the script would function
with the declaration intact.

IMO, if you are that desperate for performance improvement, VBScript is the
wrong language for you anyway.


[1] http://groups.google.com/groups?oi=d...m=an_558784968
[2] Among others,
http://groups.google.com/group/micro...3958ec80?hl=en
--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms.

[Justin Piper]

On Mon, 19 Jun 2006 11:51:12 -0500, Dave Anderson
<NY**********@s pammotel.com> wrote:

Justin Piper wrote:

8. Once working and ready for deployment, remove Option
Explicit statement
I've never heard such advice. What do you gain by doing this?

A few CPU cycles. And probably a bad habit.

As Eric Lippert has written[1], VBScript performance is vastly improved
when
variables are explicitly declared. I have seen suggestions[2] that
removing
Option Explicit from your code eliminates one parsing step during script
execution and does not harm performance as long as the script would
function
with the declaration intact.

Has this ever been corraborated, though? Or even profiled? It's one thing
for Eric Lippert to say how something works, performance-wise. It's quite
another for some guy who knows a guy who went to an ASP developer
conference to say it.

I can't even see how it would work. If omitting Option Explicit causes the
parser to skip the pass where it checks for declared variables, then it
wouldn't have an opportunity to build the name tables Eric describes, and
it would have to fall back on the hunt-all-over-everywhere strategy. It
sounds like complete bunk to me.
IMO, if you are that desperate for performance improvement, VBScript is
the
wrong language for you anyway.
Indeed. By the time you're optimising for the /parser/ you should be
investigating other options. Doesn't IIS cache script environments, anyway?
[1] http://groups.google.com/groups?oi=d...m=an_558784968
[2] Among others,
http://groups.google.com/group/micro...3958ec80?hl=en

--
Justin Piper
Bizco Technologies
http://www.bizco.com/

[Dave Anderson]

Justin Piper wrote:

I can't even see how it would work. If omitting Option
Explicit causes the parser to skip the pass where it checks
for declared variables, then it wouldn't have an opportunity
to build the name tables Eric describes, and it would have
to fall back on the hunt-all-over-everywhere strategy. It
sounds like complete bunk to me.

I don't think it's possible for the parser to not parse the script, Option
Explicit or not. I have read Lippert's post carefully, and I don't see
anything to suggest that. And I believe this sentence suggests the opposite:

"By forcing you to declare locals, Option Explicit makes you write
faster code."

Lippert seems to be saying that it is the variable declaration, and not the
Option Explicit directive, that matters.

--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms.

[Justin Piper]

On Mon, 19 Jun 2006 13:01:51 -0500, Dave Anderson
<NY**********@s pammotel.com> wrote:

Justin Piper wrote:

I can't even see how it would work. If omitting Option
Explicit causes the parser to skip the pass where it checks
for declared variables, then it wouldn't have an opportunity
to build the name tables Eric describes, and it would have
to fall back on the hunt-all-over-everywhere strategy. It
sounds like complete bunk to me.

I don't think it's possible for the parser to not parse the script,
Option
Explicit or not.

Well, if I understand the claim against using Option Explicit correctly,
it's that with it enabled there are two passes, one looking for
exclusively for Dim statements and one that processes the script. It's
possible that it works that way, but it would be a very peculiar thing to
do.

--
Justin Piper
Bizco Technologies
http://www.bizco.com/