Access, FrontPage, DRW and Cookies

Why there is no End if in the code?

Good question...not sure, but it doesn't seem to have a negative effect.  

No one has really responded to my question....I hope there's a good explanation somewhere out there!

Please Help!
John

Hi,

Did you try to put End If ?

<%
If Request.Cookies("Login")("UserID")="" Then Response.Redirect "login.asp"
End if
If Request("UserID")="" Then Response.Redirect _
Request.ServerVariables("SCRIPT_NAME") & "?" & Request.Cookies("Login")
End if
If Request.Cookies("Login")("UserID") <> Request("UserID") Then _
Response.Redirect "login.asp"
End if
%>

Try that,  then we'll see what could be the problem.  Let us eliminate all suspicions one by one.

hhammash

Hi HHammash,

Believe it or not...adding the End IF statements lock me out of those pages.  After removing them I was able to get back in.  Very strange.

I've tried a bunch of things, but I'm still not able to solve the puzzle!

John

Hi,

Ok,

If the login is successful where is the user sent,  to which page?  Does that other page verify the login?

If yes try:
<%
If Request.Cookies("Login")("UserID")="" Then Response.Redirect "login.asp"
    else
     response.redirect "theotherpage.asp"
End if
If Request("UserID")="" Then Response.Redirect _
Request.ServerVariables("SCRIPT_NAME") & "?" & Request.Cookies("Login")
  else
     response.redirect "theotherpage.asp"
End if
If Request.Cookies("Login")("UserID") <> Request("UserID") Then _
Response.Redirect "login.asp"
    else
      response.redirect "theotherpage.asp"
End if
%>

Regards
hhammash

Hi HHammash,

thanks for the new code, I tried it out, but it's still not displaying the page, unfortunately.

Here's what happens, we have a navigation page called dash.asp...in order to get to that page, you need to get through the login page.  Once a user is on the dash.asp page he/she can navigate to other pages.  So for this example we'll say a user wants to look at the event calendar in our database.  So they would click on the calendar button to take them to calendar.asp.

Now here's where it get's to be a problem......the calendar.asp page allows you to select events (dropdown menu) from a set of dates that exist in the database.  This page is also protected with the cookie script....

<%
If Request.Cookies("Login")("UserID")="" Then Response.Redirect "login.asp"
If Request("UserID")="" Then Response.Redirect _
Request.ServerVariables("SCRIPT_NAME") & "?" & Request.Cookies("Login")
If Request.Cookies("Login")("UserID") <> Request("UserID") Then _
Response.Redirect "login.asp"
%>

...which works fine.  However, when a user selects a date from the dropdown and hits submit, that info gets posted to the next page called calendar_detail.asp.  This page, for some reason will not display any information with the above script present in the code.  It simply comes up in error with the browser default "Page Cannot Be Displayed" message.  Once the code is removed (the page is now unprotected) it will display the information.  This isn't terrible as you can't even get to this page without knowing it exists in the first place and having the exact address, and even still, if you went directly there, it will not display database information, but just show a blank page.  However, I'd like to be able to avoid people using wildcards to get in the database to snoop around.

I just don't get it...the answer must be something simple, but I'm not a code expert, so it makes it that much harder for to try and figure it out...

Thanks for all your help so far!
John

Hey John. Thanks for the kind words about www.FrontPageMagic.com. I'm not sure what the problem is either. As you know from my site, I'm not a coder either. I've tacked the tutorials together through trial and error and a great deal of help from people like hhamash who actually know what they are doing in the html pane of FP.

When I have problems with some of my coded pages I try posting to a file called requestsniffer.asp. What it does is display all of the data being passed to the page so that you can see if the correct parameters are being passed. Also, in Internet Explorer go to Internet Options-Advanced options and deselect the Show Friendly HTTP Error Messages. This will often give you a more detailed error message instead of the cryptic Page Cannot Be Displayed error. Here is the code for RequestSniffer.asp. Just copy it into a blank page in html view. Set your calendar page to send to this page rather than calendar_details.asp. It may help to track down the error cause.

<%@ Language=VBScript %>
<HTML><HEAD>
<META NAME="GENERATOR" Content="Microsoft Visual Studio 6.0">
<link rel="stylesheet" type="text/css" href="../../../CSS/Ward.css">
</HEAD>

<BODY>

<H3>Request Sniffer</H3><hr>
<%
' /////// Decide whether to reap data from QueryString or Form collection
If Request.QueryString <> "" Then
  call ShowQueryString
ElseIf Request.Form <> "" then
  Call ShowForm
Else
  Response.Write "Both the QueryString and Forms collection are empty"
End If


' //////// Call this if data is in Form collection

Sub ShowForm

Response.write "From Form collection - POST<BR>"
Response.Write "Total # of values = "
Response.Write Request.Form.Count & "<BR>"
Response.Write "Entire Form Collection as String: <BR>"
Response.Write Request.Form & "<BR><BR>"
Response.Write "<TABLE BORDER=1><tr>"

For Each MyItem in Request.Form
  Response.Write "<TR><TD>"  
  Response.Write MyItem & "</TD><TD>"
  Response.Write Request.Form(MyItem).Item
  Response.Write "</TD></TR>"
Next

Response.Write "</TABLE>"

End Sub


' /////// Call this if data is in QueryString collection

Sub ShowQueryString

Response.Write "From QueryString collection - GET<BR>"
Response.Write "Total # of values = "
Response.Write Request.QueryString.Count & "<BR>"
Response.Write "Entire QueryString Collection as String: <BR>"
Response.Write Request.QueryString & "<BR><BR>"
Response.Write "<TABLE BORDER=1><TR>"

For Each MyItem in Request.QueryString
  Response.Write "<TR><TD>"  
  Response.Write MyItem & "</TD><TD>"
  Response.Write Request.QueryString(MyItem).Item
  Response.Write "</TD></TR>"
Next

Response.Write "</table>"

End sub
%>

</BODY>
</HTML>

On another note, I've started using the session-based version of the tutorial rather than the cookie based. The reason is based upon security. The UserID is stored as a cookie in plain text and so the site could be hacked if someone opened the cookie file and changed the value of the UserID in the cookie file. They cannot view a session variable in the same way and so it is more difficult to hack this version. I do use cookies to store other values that are not as confidential.

You can encrypt your cookie using some fancy formula but I have no idea how to accomplish this.

Hi Ward,

Thanks to you, I think I may be on to something here....maybe the question that I should be asking is how do I post the USERID to the next page...or do I even have to if it is in the cookie already....I guess I assumed that the cookie data is always present and that the cookie script just re-requests the info whenever the page contains the script. (??)

Your request sniffer (which is VERY COOL THANK YOU!!!) shows that I am only passing the values from the form...not including the USERID....which may be why the following page is getting confused...not really sure...

Any ideas???

Thanks for al the help so far....I think MAYBE I'm getting somewhere...
John

P.S. Oh, and thanks for the advice on using session id's...again I'm really "green" with this stuff, so I'm not sure it will work for us since we are using the USERID to separate what clients will see in our database...we are anticipating many new customers and we use the USERID field to limit access.  Maybe you have some sugestions in that regard (?).  Thanks again!

You can even create a new page with a simple asp script like the following:

<% Response.Write "The cookie value is: " & RequestCookies("UserID") %>

This should display your cookie value if it exists.