Reset Password using ASP and MS Access

[hotflash]

Hi All,

I want to creat a script where I will allow user to reset their own password. I have tried different options but don't have any luck. Wonder what I want to do is kinda not valid or not.

ResetLogin.asp (where user will have to enter their username, old password, and new password).
[html]
<TR>
<TH ALIGN=LEFT> <FONT FACE="HELVETICA,HELV,ARIAL" SIZE=2>&nbsp;&nbsp;User Name: </FONT></TH>
<TD><INPUT CLASS="bluebox" NAME="Username" SIZE="25" TYPE="text" ID="Username"></TD>
</TR>

<TR>
<TH ALIGN=LEFT><FONT FACE="HELVETICA,HELV,ARIAL" SIZE=2>&nbsp;&nbsp;Old Password: </FONT></TH>
<TD><INPUT CLASS="bluebox" NAME="PassW" SIZE="25" TYPE="Password" ID="PassW"></TD>
</TR>

<TR>
<TH ALIGN=LEFT><FONT FACE="HELVETICA,HELV,ARIAL" SIZE=2>&nbsp;&nbsp;New Password: </FONT></TH>
<TD><INPUT CLASS="bluebox" NAME="NewPassW" SIZE="25" TYPE="Password" ID="NewPassW"></TD>
</TR>

<TR>
<TD ALIGN=CENTER COLSPAN=2> <INPUT CLASS="Table_Blue" TYPE="submit" NAME="Submit" VALUE="RESET/CHANGE PASSWORD"></TD>
</TR>[/html]
RCPassword.asp (this file will do the check of username, and password then update it. I am having problem to construct the portion to update the new password)

<%
Dim Conn
Dim RS
Dim strSQl
Dim strUsername
Dim strPassW
Dim strNewPassW
 
strUsername = trim(Request.Form("Username"))
strPassW = trim(Request.Form("PassW"))
strNewPassW = trim(Request.Form("NewPassW"))
 
If strUsername = "" OR _
strPassW = "" OR _
strNewPassW = "" Then
Response.Redirect("UserLogin.asp?error=Sorry ... Username or Password does not exist. Please try again.")
 
Else
 
Set Conn = Server.CreateObject("ADODB.Connection")
Conn.Open "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath("PTSystem.mdb")
 
strSQL = "Select * FROM Accounts where Username='" & strUsername & "' and PassW='" & strPassW & "'"
RS.Open strSQL, Conn
 
strSQL = "UPDATE Accounts SET NewPassW= '"& strPassW &"'"
Conn.Execute(strSQL)
 
Response.Write ("Thank You")
 
End If
 
RS.Close
Set RS = Nothing
 
Conn.Close
Set Conn = Nothing
%>

[nedu]

Hi Frnd,

I thnk the password field name of u r table is "PassW" but in the update statement u r updating the different filed "NewPassW". Please check that and let us know . . .

Regards,
Nedu . M

[hotflash]

Hi Nedu,

Thanks for your reply.

I thought NewPassW= '"& strPassW &"'" is you take the new password you enter then overwrite the existing one? Please help. Thanks again.

[nedu]

I think there is no need of newPassword field, only one password field is enough u shall replace the new pwd in that itself

[hotflash]

Hi,

It still does not work. Can you try to see if you see the same problem? Thanks.

[Nicodemas]

HotFlash, you need to SERIOUSLY look at what you are inputting. I have some advice for you, as well as some answers.

1.) Your first SQL statement is not even necessary. Get rid of it and the RS.open.

2.) Why are you updating a field called NewPassW? The password field you use to check if the user entered the right password is just: PassW. Change your second SQL statement to use PassW and not NewPassW.

3.) Your UPDATE SQL statement is too broad. If you do not put a WHERE clause on it, you will end up changing EVERY USER'S PASSWORD.

4.) You need to protect your scripts from SQL Injection Attacks. It is a form of hack. Remove malicious characters from all form input, i.e. apostrophes.

[CroCrew]

I agree with Nicodemas. You need to add more security. Try this code for your RCPassword.asp page instead of what you have.

Hope this helps~

<%
    Set adoCon = Server.CreateObject("ADODB.Connection")
    adoCon.Open "DRIVER={Microsoft Access Driver (*.mdb)}; DBQ=" & Server.MapPath("Relative path to your Access database") 
    Set rsUpdate = Server.CreateObject("ADODB.Recordset")
 
    xUsername = replace(Request.Form("Username"),"'","''")
    xPassW = replace(Request.Form("PassW"),"'","''")
    xNewPassW = replace(Request.Form("NewPassW"),"'","''")
 
    strSQL = "SELECT * FROM Accounts WHERE Username = '" & trim(xUsername) & "' AND PassW = '" & trim(xPassW) & "'"
    rsUpdate.CursorType = 2
    rsUpdate.LockType = 3
    rsUpdate.Open strSQL, adoCon
 
    If Not (rsUpdate.EOF) Then
        If ((StrComp(trim(xPassW), rsUpdate("PassW").value) = 0)) Then
            rsUpdate.Fields("PassW") = trim(xNewPassW)
            rsUpdate.Update    
            Response.Write("Password has been updated.")
            Response.end
        End If
    End If
 
    Response.Write("The combination of User Name and Current Password is bad.")
 
    rsUpdate.Close
    Set rsUpdate = Nothing
    adoCon.Close
    Set adoCon = Nothing
%>
 
 

[hotflash]

Hi Crocrew/Nicodemas,

You guys are the BEST. Everything works fine. Thanks for your help. I have another (last issue) of my tiny project here and wonder if you guys can help me out. I found a script to upload file (MS word, etc...), and description to the MS Access. I got it work fine. I created a search feature to either search by record number or description OK. My question is, how can I view the file I uploaded to MS Access from the web browser?

FYI that MOPID = AutoNumber
Description = Text
Data = Ole Object
both of these fields are defined in the MS Access. Below is the script that I used. The description show up OK after the search however, how can i display the file I uploaded to the MS Access so when the user click on VIEW (below), it will open up the file. Thanks once again for your help.

WHILE NOT RS.EOF

Response.Write("<TR>")
Response.Write("<TD>" & RS("Description") & "&nbsp;</TD>")
Response.Write("<TD><A HREF=Data?MOPID=" & RS("MOPID") & ">View</A></TD>")
Response.Write("</TR>")

RS.MoveNext
Wend