Help with javascript validation

[markdt]

Hi,

I have five select boxes on my ASP web page of which i would like to check against the logged in user id and verify whether or not they are allowed to sign off this particular form. My five select boxes contain a number of different users.

My problem arises when the first select box 1 is signed off by user A. Then user B logs in and trys to sign off select box 2, my code below continues to check select box 1 against the logged in user which i dont want to happen. I know this might sound complicated! So if anyone has any suggestions that would be greatly received. Thanks

<script language="JavaScript" type="text/javascript"> 
<!--
function validateMyForm3() {
with (document.form4) {
var juserid = "<%=Session("userid")%>";
var ja2eng = "<%=a2eng%>";
var ja2qua = "<%=a2qua%>";
var ja2man = "<%=a2man%>";
var ja2plan = "<%=a2plan%>";
var ja2purch = "<%=a2purch%>";
var alertMsg = "You are not authorized to sign off:\n";
if ((selA2Eng.value != "Please Select...") || (ja2eng.value == ""))
{
if (selA2Eng.value != juserid) alertMsg += "\nEngineering";
}
if ((selA2Qua.value != "Please Select...") || (ja2qua.value == ""))
{
if (selA2Qua.value != juserid) alertMsg += "\nQuality";
}
if ((selA2Man.value != "Please Select...") || (ja2man.value == ""))
{
if (selA2Man.value != juserid) alertMsg += "\nManufacturing";
}
if ((selA2Plan.value != "Please Select...") || (ja2plan.value == ""))
{
if (selA2Plan.value != juserid) alertMsg += "\nPlanning";
}
if ((selA2Purch.value != "Please Select...") || (ja2purch.value == ""))
{
if (selA2Purch.value != juserid) alertMsg += "\nPurchasing";
}
if (alertMsg != "You are not authorized to sign off:\n") {
alert(alertMsg);
return false;
} else {
return true;
} } }
//-->
</script>

 

[Ferrian]

You're using Javascript to validate users? Are you aware that this gives all the information to a user of the website? I can't work out whether you're actually printing out important information, but if you're using ASP then you should try to do as much as possible server side, rather than client side.

The client side variables will be set each time the page loads, are you remaining on this page and logging in as each user without refresh?

You also need to check that your Session variables in the ASP are being changed each time a user logs in and out.

I'd really need to see more context of the ASP page to help further.

~Ben
Occasional sparks in a darkened room