asp errors

[telexpress]

I continue to get this error:

Server.MapPath() error 'ASP 0175 : 80004005'
Disallowed Path Characters
/inventory/config.asp, line 3
The '..' characters are not allowed in the Path parameter for the MapPath method.

for this code in config.asp:
<%
cst = &quot;Provider=Microsoft.Jet.OLEDB.4.0;Data Source=&quot;
cst = cst & server.mappath(&quot;../inventusers/login.mdb&quot
%>



I fix that and then get this error:

Microsoft VBScript runtime error '800a000d'
Type mismatch: 'Session'
/inventory/check.asp, line 4


for this code in check.asp:

<%
go = ajloginurl+&quot;login.asp?stat=notin&quot;
if Session(&quot;UserGood&quot <> &quot;True&quot; then
response.redirect (&quot;&quot;&go&&quot;&quot
end if
%>

 

[onpnt]

what exactly are you checking for here
<%
go = ajloginurl+&quot;login.asp?stat=notin&quot;
if Session(&quot;UserGood&quot <> &quot;True&quot; then
response.redirect (&quot;&quot;&go&&quot;&quot
end if
%>

a true value (boolean) or a string = &quot;true&quot; ??

redirect does not get the ( ) and go should be set alone without the &quot; &quot;
the redirection will occur without them and specifying the variable _________________________________________________________
for the best results to your questions: FAQ333-2924
[sub]01001111 01101110 01110000 01101110 01110100[/sub]

[sup]

http://www.onpntwebdesigns.com

[/sub]

 

[telexpress]

Basically it is a check to see if the login information is correct. If not, it will redirect back to the login page with a message to the user located by the &quot;notin&quot; variable.

 

[telexpress]

I get this error:

Microsoft VBScript runtime error '800a000d'
Type mismatch: 'Session'
/inventory/check.asp, line 4


Here is the code sequence:

config.asp:
<%
cst = &quot;Provider=Microsoft.Jet.OLEDB.4.0;Data Source=&quot;
cst = cst & server.mappath(&quot;/inventusers/login.mdb&quot
sitename=&quot;company&quot;
headimg=&quot;

http://www.domain.com/assets/images/logosmall.gif&quot;

yoursitehome=&quot;

http://www.domain.com&quot;

membersonly=&quot;

http://telex2k.domain.com/inventory/memtest.asp&quot;

adminpage = &quot;

http://telex2k.domain.com/inventory/admindefault.asp&quot;

loginurl=&quot;

http://telex2k.domain.com/inventory/&quot;

inventoryurl=&quot;

http://telex2k.domain.com/inventory/searchinv.asp&quot;

%>


check.asp:
<!--#INCLUDE file=&quot;config.asp&quot;-->
<%
go = loginurl+&quot;login.asp?stat=notin&quot;
if Session(&quot;UserGood&quot <> &quot;True&quot; then
response.redirect (&quot;&quot;&go&&quot;&quot
end if
%>


login.asp:
<form method=&quot;post&quot; name=&quot;form1&quot; action=&quot;login2.asp&quot;>
<%
select case stat
case &quot;badname&quot;
response.write (&quot;<p><span class=error>Incorrect Username</span></p>&quot
case &quot;badpass&quot;
response.write (&quot;<p><span class=error>Incorrect Password</span></p>&quot
case &quot;notin&quot;
response.write (&quot;<p><span class=error>You Are Not Currently Logged In.</span></p>&quot
case &quot;notadmin&quot;
response.write (&quot;<p><span class=error>You Are Not Currently Logged In As The Admin.</span><</p>&quot
case &quot;logout&quot;
response.write (&quot;<p><span class=error>You Are Now Logged Out.</span></p>&quot
end select
%>
<span class=&quot;text&quot;><br>
<font face=&quot;Arial&quot;>Username<br>
<input type=&quot;text&quot; size=&quot;40&quot; name=&quot;username1&quot; maxlength=&quot;255&quot;>
<br>
<br>
Password<br>
<input type=&quot;password&quot; size=&quot;40&quot; name=&quot;password1&quot; maxlength=&quot;255&quot;>
<br>
<span class=&quot;text&quot;><font color=&quot;#CCCCCC&quot; size=&quot;2&quot;>Forget your password? Click <a href=&quot;mailto:webmaster@domain.com?subject=Password Inquiry&quot;>here</a>
to email webmaster.</font></span> <br>
</font></span>
<p><font face=&quot;Arial&quot;>
<input type=&quot;Submit&quot; value=&quot;Sign In&quot; name&quot;b1&quot;>
</font></p>
<p><font face=&quot;Arial&quot;><br>
<span class=&quot;text&quot;><font color=&quot;#CCCCCC&quot;>If you're not already a member,
</font></span><font color=&quot;#CCCCCC&quot;><a href=&quot;reg.asp&quot;> Register Here</a> Free.</font></font></p>
<p> </p>
</form>


login2.asp:
<!--#INCLUDE file=&quot;config.asp&quot;-->
<%
strUserName = request(&quot;username1&quot
strPassword = request(&quot;password1&quot

Set conn = Server.CreateObject(&quot;ADODB.Connection&quot
Set rs = Server.CreateObject(&quot;ADODB.Recordset&quot
sql = &quot;SELECT pass FROM tblusers WHERE username ='&quot; & strUserName & &quot;'&quot;
Conn.Open cst
rs.open sql, conn
If NOT rs.EOF Then

If strPassword = rs(&quot;pass&quot Then

Session(&quot;UserGood&quot = &quot;True&quot;

Set adoCon = Nothing
Set strCon = Nothing
Set rsCheckUser = Nothing

Session(&quot;UserName&quot = strUserName
if Session(&quot;UserName&quot = &quot;admin&quot; then Response.Redirect (&quot;&quot;& adminpage &&quot;&quot
Response.Redirect (&quot;&quot;& membersonly &&quot;&quot
End If
Else
Session(&quot;UserGood&quot = &quot;False&quot;
Session(&quot;UserName&quot = &quot;You are not Currently Logged In.&quot;
response.redirect &quot;login.asp?stat=badname&quot;
End If

Set adoCon = Nothing
Set strCon = Nothing
Set rsCheckUser = Nothing

Session(&quot;UserGood&quot = False

Response.Redirect &quot;login.asp?stat=badpass&quot;
%>

 

[cathyw]

I think onpnt was onto something a bit earlier concerning the data type of Session(&quot;UserGood&quot. In login2.asp, in all cases except one, you set it as a string (i.e. Session(&quot;UserGood&quot = &quot;True&quot, but in the 2nd to last line, you set Session(&quot;UserGood&quot = False (no quotes, which would be interpreted as boolean). My guess is that if you use strings all the way through or booleans all the way through, this might fix it.

Hope that helps,
Cathy

 

[telexpress]

I changed that and it still says the same thing, could it be a problem with my webserver because I was having problems with it earlier.

 

[telexpress]

I put the check.asp into the page that I want protected, so it is checking if I am signed in through the check.asp

 

[telexpress]

If there is a better way, please let me know.

 

[Hodack]

When you changed the Session statements and tried again, did you first close your browser and start again? If not, your previous session variable was probably still active.

Change all the Session(&quot;UserGood&quot statements throughout the code to be either boolean or string.

Session(&quot;UserGood&quot = &quot;True&quot;

is not the same as

Session(&quot;UserGood&quot = True


***OR***

If you can convert the data type upon evaluation. For example, this would work for you too:

if CSTR(Session(&quot;UserGood&quot) <> &quot;True&quot; then


This will convert Session(&quot;UserGood&quot into a string, regardless of what it was before.

Hope this helps.