Passwords and Cookies

[newbieprogramme]

Hi-
I am trying to password protect my website so that members are the only ones allowed in to the interesting content :)

Here is what is going on:

There is a FORM called where users log in:

<form action="/FOLDER/test.asp" method="post" name="memberform">
<table cellspacing="0" cellpadding="3" align="center">
<tr>
<td>
<div align="center">
<input type="text" name="Username" value="Username" size="15">
</div>
</td>
<td rowspan="2" width="53">
<div align="right">
<a href="javascript:document.memberform.submit();">
<img src="/images/login.gif" width="49" height="23" border="0">
</a>
</div>
</td>
</tr>
<tr>
<td>
<div align="center">
<input type="text" name="Password" value="Password" size="15">
</div>
</td>
</tr>
</table>
</form>

End FORM




There is a page called TEST.ASP which contains the following:


CheckLogin = 0

Checks for previous cookies for basic users
If Request.Cookies("LoggedIn") = "1" Then
CheckLogin = 1
End If

Checks for previous cookies for advanced users
If Request.Cookies("AdvLoggedIn") = "1" Then
CheckLogin = 1
End If

Checks User ID and PW from the form and creates a cookie as needed for advanced users
If Request.Form("Username") = "ADVANCED" and Request.Form("Password") = "sunshine" Then
CheckLogin = 1
Response.Cookies("AdvLoggedIn") = "1"
Response.Cookies("LoggedIn") = "1"
End If

Checks User ID and PW from the form and creates a cookie as needed for basic users
If Request.Form("Username") = "BASIC" and Request.Form("Password") = "smile" Then
CheckLogin = 1
Response.Cookies("LoggedIn") = "1"
End If

Checks the cookie and directs BAD logins to the invalid page
If CheckLogin = 0 Then
Response.Redirect("/FOLDER/invalid.asp")
End If

Checks the cookie and directs GOOD logins to the membersonly page
If CheckLogin = 1 Then
Response.Redirect("/FOLDER/membersonly.asp")
End If


End TEST.ASP




In the HEADER of each protected page there is a link to a check of the cookies:

#include virtual="/FOLDER/-check.asp"

End HEADER check

The -CHECK.ASP page looks almost identical to the TEST.ASP page. In anycase It is not working. I am directed to invalid no matter what and I cannot figure out where I went wrong!

Thanks!

[Bullschmidt]

Hi and welcome to the board!

Your code worked just fine for me.

Examples:
- Username of BASIC and Password of smile got redirected to membersonly.asp
- Username of BASIC and Password of smilezz got redirected to invalid.asp
- Username of ADVANCED and Password of sunshine got redirected to membersonly.asp
- Username of ADVANCED and Password of sunshinezz got redirected to invalid.asp

But the way you have it things ARE case-sensitive so these possibly unintended results also happened:
- Username of basic and Password of smile got redirected to membersonly.asp
- Username of advanced and Password of sunshine got redirected to membersonly.asp

So if you don't want case sensitivity you may want to use LCase() such as:

If (LCase(Request.Form("Username")) = "basic") And (LCase(Request.Form("Password")) = "smile") Then

And also often people make a password field NOT show the actual text so that other people can't see what is being typed:

<input type="password" name="Password" value="Password" size="15">