controlling access to parts of a site

[Geoff Wickens]

I have been trying to control access to some pages on my website for some
time without success. I have tried copying the code found on the web:

I created a page (loginform.asp) with the following form:

<form action=loginhan dler.asp method=post>
Username: <input type=text name='username' ><BR>
Password: <input type=password name='password' ><BR>
<input type=submit Value='Log In'><BR>
</form>
I then created a page (loginhandler.a sp) to handle this:

<%
u = lcase(request.f orm("username") )
p = lcase(request.f orm("password") )

'---------------------------------------------------------
'-- check to see that the form was completely filled out--
'---------------------------------------------------------
if u="" or p="" then
response.redire ct("loginform.a sp")
end if

if u<>"myusername " or p<>"mypassword " then

'access denied
response.redire ct ("loginform.asp ")
else

' let them in!
session("login" )=true
response.redire ct ("hiThere.as p")
end if
%>

I then put the following code at the top of pages I want to be secure:

<%
if not session("login" ) then
response.redire ct("loginform.a sp")
end if
%>

Everything worked well until I did the last stage. Now whether I am logged
on or not I am redirected back to my loginform.asp page.

I am using PWS with Windows 98 to test the page locally.

Can anyone suggest where I am going wrong?

Geoff Wickens

[only me]

The 1st thing to do in such cases, is response.write something so you can
get a handle on whats really happening as opposed to what you think is
happening

so I would change your
response.redire ct("loginform.a sp")
to be
response.write "[" & session("login" ) & "]

and see what you getting

session variables are always passed as text, so you may need to cast the
session var prior to using the NOT

I usually tend to test as follows
if session("varaib le") <> "" then
or
if session("varaib le") = "something specifc" then
"Geoff Wickens" <gw******@hotma il.com> wrote in message
news:ix******** ******@newsfep1-gui.server.ntli .net...

I have been trying to control access to some pages on my website for some
time without success. I have tried copying the code found on the web:

I created a page (loginform.asp) with the following form:

<form action=loginhan dler.asp method=post>
Username: <input type=text name='username' ><BR>
Password: <input type=password name='password' ><BR>
<input type=submit Value='Log In'><BR>
</form>
I then created a page (loginhandler.a sp) to handle this:

<%
u = lcase(request.f orm("username") )
p = lcase(request.f orm("password") )

'---------------------------------------------------------
'-- check to see that the form was completely filled out--
'---------------------------------------------------------
if u="" or p="" then
response.redire ct("loginform.a sp")
end if

if u<>"myusername " or p<>"mypassword " then

'access denied
response.redire ct ("loginform.asp ")
else

' let them in!
session("login" )=true
response.redire ct ("hiThere.as p")
end if
%>

I then put the following code at the top of pages I want to be secure:

<%
if not session("login" ) then
response.redire ct("loginform.a sp")
end if
%>

Everything worked well until I did the last stage. Now whether I am logged
on or not I am redirected back to my loginform.asp page.

I am using PWS with Windows 98 to test the page locally.

Can anyone suggest where I am going wrong?

Geoff Wickens

[jbongran]

Geoff Wickens wrote:

I have been trying to control access to some pages on my website for
some time without success. I have tried copying the code found on the
web:

I created a page (loginform.asp) with the following form:

<form action=loginhan dler.asp method=post>
Username: <input type=text name='username' ><BR>
Password: <input type=password name='password' ><BR>
<input type=submit Value='Log In'><BR>
</form>
I then created a page (loginhandler.a sp) to handle this:

<%
u = lcase(request.f orm("username") )
p = lcase(request.f orm("password") )

'---------------------------------------------------------
'-- check to see that the form was completely filled out--
'---------------------------------------------------------
if u="" or p="" then
response.redire ct("loginform.a sp")
end if

if u<>"myusername " or p<>"mypassword " then

'access denied
response.redire ct ("loginform.asp ")
else

' let them in!
session("login" )=true
response.redire ct ("hiThere.as p")
end if
%>

I then put the following code at the top of pages I want to be secure:

<%
if not session("login" ) then
response.redire ct("loginform.a sp")
end if
%>

Everything worked well until I did the last stage. Now whether I am
logged on or not I am redirected back to my loginform.asp page.

I am using PWS with Windows 98 to test the page locally.

Can anyone suggest where I am going wrong?

Geoff Wickens

You didn't set the session variable a value in all cases:
If u<>"myusername " or p<>"mypassword " then
'access denied
set Session("login" ) = False
response.redire ct ("loginform.asp ")
Else
' let them in!
Set Session("login" ) = True
Response.Redire ct ("hiThere.as p")
End if

And in each of your secured pages you must Cast the session value as a boole
an:
If Not CBool(Session(" login")) Then
Response.Redire ct("loginform.a sp")
End If