Comparing a session value to a querystring

[Spoogledrummer]

Hi,

I'm attempting to limit access to a page without creating a whole load of session values and there for re-writing the page. So I've come up with the following code on a test page

<%@ Language=VBScript %>
<%Option Explicit%>
<%
IF session("Userid")<>request.Querystring("Stu") and session("Userid2")<>request.Querystring("Stu") Then
        response.redirect "../../login/errors/notloggedin.asp"
End if
%>
 

This in theory should prevent the user from editing the url themselves as if their session value doesn't match the value in the url it should re-direct them to an error. For some reason it's not working though even though that's literally all the code there is on the page.

If I get it to print out the session userid and the url stu value they are the same yet it still redirects me to the error page. What am I missing?

[deric]

How about the Userid2, is it the same with the Stu value?
I'm not sure, but you can try converting the session values to string...

[Spoogledrummer]

userid2 would be blank if userid has a value. It's basically 2 different applications sharing the same pages so the user will only ever have one or the other. I'll give the string thing a try. Thanks

[deric]

So that's it.. either of the two condition should work, then you should use the OR operator and not the AND.

IF session("Userid")<>request.Querystring("Stu") OR session("Userid2")<>request.Querystring("Stu") Then

If any one of them is true, then the result is true.
If both are false, then the condition is not satisfied, it will result to false and will not go inside of the IF.
Btw, you need not convert them to string.

[Spoogledrummer]

So that's it.. either of the two condition should work, then you should use the OR operator and not the AND.

IF session("Userid")<>request.Querystring("Stu") OR session("Userid2")<>request.Querystring("Stu") Then

If any one of them is true, then the result is true.
If both are false, then the condition is not satisfied, it will result to false and will not go inside of the IF.
Btw, you need not convert them to string.

Thanks but using OR wouldn't work. The aim is to redirect the user if they try to access a page that doesn't have their userid in the url. So as they will only have either userid or userid2 and the other will always be blank switching it to an or will cause them to be re-directed all the time even when trying to access their own page.