Hello All!
I guess this question is more for Ward Cameron since I got the cookie script from his frontpagemagic.com site...but if anyone has an easy solution by all means!! By the way Ward, thank you for making such a page it has been very, very helpful.
OK the question (dilemma really) is that we are creating a webpage that limits information with the userid cookie script that Ward provided. Our site allows certain property owners to view their own property's information and not another owner's properties or info. Thus far it has worked very well. BUT we are finding that by using the following cookie code...
<%
If Request.Cookies("Login")("
UserID")="
" Then Response.Redirect "login.asp"
If Request("UserID")="" Then Response.Redirect _
Request.ServerVariables("S
CRIPT_NAME
") & "?" & Request.Cookies("Login")
If Request.Cookies("Login")("
UserID") <> Request("UserID") Then _
Response.Redirect "login.asp"
%>
...on a page that has a form with a dropdown menu, it prevents us from displaying certain data on a following page while the same code is still present. We have tried several ways to pass parameters, etc. (and have triple-checked that all the queries contain the criteria that is being posted to the page) BUT we have only found that by removing the cookie code, for that page only, it will allow for data from our database (MS Access) to be displayed using DRW.
There must be some easy solution, because other sites are doing it. Our real concern is that we don't want hackers to view data on the unprotected pages that they are not entitled to view, obviously. The good news is that no one can't get to the page containing information without having logged in properly and viewed information that is owner specific...however once they are on this page in particular, they can change the string of code in the address bar and view information that they are not entitled to see.
Can you help? I hope what I wrote makes sense...
Thanks!
John
