Hi,
I have this website where a small portion of the site should only be available to certain users. I'm using using a database to store UserIDs. I have a login form which checks if they are in the db, if so allows them to the first page and stores the UserID as a session variable. The thing is that if other users some how know the URLs of these pages (like in the history)they can gain access. I though I would use an include asp file which compares the userID (session variable) with the valid users in the db and place it in the pages I want to protect. I called it Checkuser.asp. The first page is a framed page I put the include file at the top of the page before the <html> as such <!--#include file="Checkuser.asp"-->. It does the checking but fails to write the html if the inc file permits access. If I replace the inc file with the script contained in the inc file it works. Any thoughts would be appreciated.
SteveDi
<%
Option Explicit
Const adStateClosed = &H00000000
Const adStateOpen = &H00000001
Dim adoCon
Dim ConStr
Dim adoFindUser
Dim strAccessDB
Dim UserID
Dim strFindUser
On Error Resume Next
UserID = Session("UserID"
strAccessDB = "../fpdb/actedms"
Set adoCon = Server.CreateObject("ADODB.Connection"
Set adoFindUser = Server.CreateObject("ADODB.Recordset"
ConStr="DRIVER={Microsoft Access Driver (*.mdb)};"
ConStr = ConStr & "DBQ=" & server.mappath(strAccessDB)
adoCon.open ConStr
strFindUser = "SELECT UserID FROM UserNames WHERE UserID = '" & UserID & "'"
adoFindUser.Open strFindUser, adoCon
If adoFindUser.eof Then
'if no user is found then redirect to login
Response.Redirect"Login.htm"
Else
'do nothing and continue writing the page
End If
Set adoFindUser = Nothing
If adoCon.State = adStateOpen Then
adoCon.Close
End If
Set adoCon = Nothing
%>
I have this website where a small portion of the site should only be available to certain users. I'm using using a database to store UserIDs. I have a login form which checks if they are in the db, if so allows them to the first page and stores the UserID as a session variable. The thing is that if other users some how know the URLs of these pages (like in the history)they can gain access. I though I would use an include asp file which compares the userID (session variable) with the valid users in the db and place it in the pages I want to protect. I called it Checkuser.asp. The first page is a framed page I put the include file at the top of the page before the <html> as such <!--#include file="Checkuser.asp"-->. It does the checking but fails to write the html if the inc file permits access. If I replace the inc file with the script contained in the inc file it works. Any thoughts would be appreciated.
SteveDi
<%
Option Explicit
Const adStateClosed = &H00000000
Const adStateOpen = &H00000001
Dim adoCon
Dim ConStr
Dim adoFindUser
Dim strAccessDB
Dim UserID
Dim strFindUser
On Error Resume Next
UserID = Session("UserID"
strAccessDB = "../fpdb/actedms"
Set adoCon = Server.CreateObject("ADODB.Connection"
Set adoFindUser = Server.CreateObject("ADODB.Recordset"
ConStr="DRIVER={Microsoft Access Driver (*.mdb)};"
ConStr = ConStr & "DBQ=" & server.mappath(strAccessDB)
adoCon.open ConStr
strFindUser = "SELECT UserID FROM UserNames WHERE UserID = '" & UserID & "'"
adoFindUser.Open strFindUser, adoCon
If adoFindUser.eof Then
'if no user is found then redirect to login
Response.Redirect"Login.htm"
Else
'do nothing and continue writing the page
End If
Set adoFindUser = Nothing
If adoCon.State = adStateOpen Then
adoCon.Close
End If
Set adoCon = Nothing
%>