Click on link store value in sess variable

[jasonhuibers]

The below code is displaying all the Events. How can I have it that when the user clicks on one of the links the eventname is carried over to the TestHistory1.asp page?
I would prefer to store the value into a session variable


do while not drs.eof
session("RecordNumber") = drs("EventName")
Response.Write "<tr>"
Response.Write "<td width='140'><font face='Tahoma'><font type='Tahoma' size='1'><a href='TestHistory1.asp'>" & drs("EventName") & "</td>"
Response.Write "<td width='50'><font face='Tahoma'><font type='Tahoma' size='1'>" & drs("Count") & "</td>"
Response.Write "</tr>"
drs.MoveNext
Loop
Response.Write "</table>"

 

[ggriffit]

simplest way is to pass them in the Query String, something like :

Response.Write "<td width='140'><font face='Tahoma'><font type='Tahoma' size='1'><a href='TestHistory1.asp?eventname=" & drs("EventName") & "'>" & drs("EventName") & "</td>"

Greg Griffiths
Livelink Certified Developer & ECM Global Star Champion 2005 & 2006

http://www.greggriffiths.org/livelink/

 

[jasonhuibers]

Is there a way I can store the value into a session variable? If I pass VIA query string - the user can take the string and access other records not associated to him...

 

[ggriffit]

Jason,
however you store the data, it is still being generated by the user, so you are open to them changing the value that they pass down to you, so you WILL need to ensure that your code checks to see if they should have access to do something even if they request it.

To get the data server side it will have to be passed, if you don't want to use a Query String, I guess you could use a FORM POST event or some AJAX type event to populate your session object.

Whichever approach you decide on the "the user can take the string and access other records not associated to him." issue will still remain.

Greg Griffiths
Livelink Certified Developer & ECM Global Star Champion 2005 & 2006

http://www.greggriffiths.org/livelink/

 

[evr72]

I have done smething similar, my approach is not too pretty but so far it has worked for me. I have a log in page, the user logs in to see and edit his/her data, the user then wants to navigate to another page to see and edit only his/her data. Not sure if this is what you might want but here is the code that I use on each page that the user wants to navigate to

<%
Username = Request.Form("txtUsername")	
	Password = Request.Form("txtPassword")
	
	'Build connection with database
	set conn = server.CreateObject ("ADODB.Connection")		
	conn.Open "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & server.MapPath ("..\..\..\db.mdb")
	set rs = server.CreateObject ("ADODB.Recordset")

	'rs.Open "SELECT userid FROM yourtable Where Where FECHNB='" & Session("Username")& "'", conn
	rs.Open "SELECT * FROM comparison where username='" & Session("Username")& "'", conn, 1 
	
	Dim presentuserid

presentuserid=rs("userid")

'then on your sql statement

SQL = "select field1,   field2,   field3 From mytable Where userid = " &presentuserid& ""
%>