Session question

[jimmythegeek]

I have an ASP Login page that opens SQL Server and sets a session variable

Session("AdminPassword&quot

Works fine.

My question is, if I use client side validation to verify the password the user enters, can I NOT refer to the session variable because it is not running at the server? I am currently getting an error "Type Mismatch session"

===============
<Script Language=&quot;VBScript&quot;>
Sub cmdSubmit_OnClick()
If document.frmLogin.elements(&quot;txtPassword&quot.value = Session(&quot;AdminPassword&quot Then
document.location = &quot;admin.asp&quot;
Else
MsgBox &quot;You have entered an incorrect password, please try again.&quot;, 64, &quot; Incorrect Password&quot;
document.frmLogin.elements(&quot;txtPassword&quot.focus
End If
End Sub
</Script>
===============

If I cannot do it this way, is there a way to mix client side script with session variables. I hope I asked the question correctly.

Thanks in advance. Jim Lunde
compugeeks@hotmail.com
We all agree your theory is crazy, but is it crazy enough?

 

[rac2]

No, the client does not have access to session variables. You could, in the ASP script, write the value of a session variable into the HTML as a hidden form element. The client-side script could then get it. And of course the ASP script has access to form data.

 

[jimmythegeek]

I thought about that, but if the user views the page source, won't they see the value that you've written to html? Jim Lunde
compugeeks@hotmail.com
We all agree your theory is crazy, but is it crazy enough?

 

[link9]

Yes, they will be able to see it.

However, what I do sometimes is have a main page, which pops up a window asking for password. They enter the password, hit submit, the popup reloads itself, validates the password, and then either

(1) closes the window and lets them continue

or

(2) redirects the main page to a login error page, or just reloads the main page, popping the window again, indicating they entered an invalid password.

In both cases, when the popup is done, it will close.

Lemme know if you would like some code, but that's the basic idea.


paul

 

[SrinuReddy]

hey oce the user enters his username and password and submits the form instead of puting the password in the session vriables, validate the password with the entered on. If they are correct then proceed else send him/her back to login page and write an error message saying wrong password.