Global.asa

here's a good point of reference for ya:
http://www.w3schools.com/asp/asp_cookies.asp

I also have another question it relates to the one you answered before. If I restart the server and type in the url to search.asp, as the session = "" it redirects to login. If the user then logs in correctly and then clicks the logout link which runs this code:-

<%
Session.Abandon()
Session.Contents.RemoveAll()
response.redirect("adminlogin.asp")
%>

The user shouldn't then be able to view search.asp without logging in as i have printed the session to the screen in login and it is blank. However this isn't the case as the server some how is remembering the session and search can be viewed. Why is this and can this be prevented.

Session.Abandon()
Session.Contents.RemoveAll()

kills all session variables.  Only thing I can think of is a cookie.  Can you post the code for adminlogin.asp?

Using the code below stops the cache another EE expert got it.

Response.CacheControl = "no-cache"
Response.AddHeader "Pragma", "no-cache"
Response.Expires = -1

However back to the global.asa file, i am finding it hard to sort . Basically all i need is for the session to be blanked if the user doesn't logout. The code below contains the functions i need but also extra coud you pull out the functions i need or explain each line.


<SCRIPT LANGUAGE=VBScript RUNAT=Server>


Sub Application_OnStart

Application("visits")
Application("Active") = 0


'      The connection string to the mdb.
Application("connString") = "Driver={Microsoft Access Driver (*.mdb)};Dbq=C:\Inetpub\wwwroot\online_Users\Online.mdb;Uid=Admin;Pwd=pass;"

End Sub



Sub Application_OnEnd
End Sub
Sub Session_OnStart


      
Session.Timeout = 20
Session("Start") = Now
Application.Lock
Application("visits") = Application("visits") + 1
intTotal_visitors = Application("visits")
Application.Unlock

Session("VisitorID") = intTotal_visitors
Application.Lock
Application("Active") = Application("Active") + 1
Application.Unlock
End Sub


Sub Session_OnEnd



set conn = Server.CreateObject ("ADODB.Connection")
      conn.Open Application("connString")
      
Dim update__MMColParam
update__MMColParam = "1"
if (Session("MM_Username") <> "") then update__MMColParam = Session("MM_Username")
      

      ' Update the record when the user logout and write the logout time
      ' plus it sets the user as OFFLINE.
      query = "UPDATE tblActiveusers SET LoggedOut=  now() , Online=1 "
      query = query & "WHERE Online=0 AND  Username= '" + Replace(update__MMColParam, "'", "''") + "'"
      
      conn.Execute (query)
      conn.Close
      set conn = Nothing


Application.Lock
Application("Active") = Application("Active") - 1
Application.Unlock

End Sub
</script>

right in here:Sub Session_OnEnd



set conn = Server.CreateObject ("ADODB.Connection")
     conn.Open Application("connString")
     
Dim update__MMColParam
update__MMColParam = "1"
if (Session("MM_Username") <> "") then update__MMColParam = Session("MM_Username")
     

     ' Update the record when the user logout and write the logout time
     ' plus it sets the user as OFFLINE.
     query = "UPDATE tblActiveusers SET LoggedOut=  now() , Online=1 "
     query = query & "WHERE Online=0 AND  Username= '" + Replace(update__MMColParam, "'", "''") + "'"
     
     conn.Execute (query)
     conn.Close
     set conn = Nothing


Application.Lock
Application("Active") = Application("Active") - 1
Application.Unlock

End Sub

you can put session("sessionname") = "", however, please keep in mind what I posted earlier about what happens if a user just goes to another page, or their computer crashes, etc...

Why does the script need to be conn to the database could this be removed, i have coppied this script from the net.

in the Session_OnEnd.  Looks like it is there to update a table with the logged out time of the user.  It's your call to remove it or not, just keep in mind your application may be expecting a use for this, like some kind of report, or list of logged out users and the times they logged out at.

in the Application_OnStart section, the conn is set there so it can be readily available for all web applications on the server.  While this is not the route I would do it, it is not a bad idea.

Would this work appart from the crashing.

<SCRIPT LANGUAGE=VBScript RUNAT=Server>

Sub Session_OnStart
Session.Timeout = 20
Session("Start") = Now
Application.Lock
Application("visits") = Application("visits") + 1
intTotal_visitors = Application("visits")
Application.Unlock

Session("VisitorID") = intTotal_visitors
Application.Lock
Application("Active") = Application("Active") + 1
Application.Unlock
End Sub

session("sessionname") = "",

</script>

It would work, however, without:Application("connString") = "Driver={Microsoft Access Driver (*.mdb)};Dbq=C:\Inetpub\wwwroot\online_Users\Online.mdb;Uid=Admin;Pwd=pass;"
 in it you will have to go through every one of your files, and make sure to update every instance of Application("connString"), otherwise the whole application will fail.

Also:  You would need to do this

Sub Session_OnEnd
     session("sessionname") = ""
     Application.Lock
     Application("Active") = Application("Active") - 1
     Application.Unlock
End Sub

in order for that to work correctly, otherwise like it is is making session("sessionname") = "" all the time, which would is pointless to do, plus the Application("Active") would not be an accurate count with out it

In search the code is now:-

<!--#include file="global.asa"-->



<%
'Check if user is logged in

Response.CacheControl = "no-cache"
Response.AddHeader "Pragma", "no-cache"
Response.Expires = -1



if Session("username") = "" then
     'If not, go to login page
     Response.Redirect("adminlogin.asp?error=2")
else
%>
<html>
<Head>
<link href="css/css.css" rel="stylesheet" type="text/css">
<style type="text/css">
<!--

div.test {
     width: 500px;
     height:300px;
     margin-bottom: 0px;
     margin-left: 10px;
     margin-right: 10px;

}
#auto {
     overflow: auto;
}

td {padding: 0px;}
-->
</STYLE>
</head>

<body bgcolor="#000000" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">

<body scroll="no" border="no" style="border-style: groove; border-width: 0">
<table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0">
  <tr>
    <td><table width="856" height="428" border="1" align="center" cellpadding="0" cellspacing="" bordercolor="#ffffff">
        <tr bordercolor="#FFFFFF">
          <td height="64" colspan="5" align="left" valign="top" bordercolor="#990000" bgcolor="#990000"><img src="images/CFLogo.jpg" width="330" height="50">
            <div align="center"></div></td>
          <td width="31" rowspan="2" valign="bottom" bordercolor="#990000" bgcolor="#990000">&nbsp;</td>
        </tr>
        <tr bordercolor="#FFFFFF">
          <td width="349" align="center" valign="middle" bordercolor="#990000" bgcolor="#990000"><img src="images/admin.jpg" width="250" height="188">
          </td>
          <td height="300" colspan="4" align="center" valign="top" bordercolor="#FFFFFF" bgcolor="#000000">
            <div align="center">
              <h1><%Response.Write(Session("username"))%></h1>
            </div><DIV CLASS="test" ID="auto">


<FORM id=FORM1 name=FORM1 action="list.asp" method=post>
<P>
  <TABLE cellSpacing=0 cellPadding=0 align=center bgColor=#000000 border=0>
    <TR align="center">
      <TD width="80"><font size=1 color=#ffffff>User Name</font></TD>
      <TD width="80"><FONT size=1 color=#ffffff>Logged in</FONT></TD>
      <TD width="80"><FONT size=1 color=#ffffff>IP Address</FONT></TD>
      <TD width="80"><FONT size=1 color=#ffffff>Sort</FONT></TD>
      <TD colspan="2">&nbsp;</TD>
    </TR>
    <TR align="center">
      <TD> <INPUT style="WIDTH: 60px" width="60" id=text1 name=text1></TD>
      <TD> <INPUT style="WIDTH: 60px" width="60" id=text2 name=text2></TD>
      <TD> <INPUT style="WIDTH: 60px" width="60" id=text4 name=text4></TD>
      <TD> <SELECT id=select1 name=Combo1>
          <OPTION value=>User Name</OPTION>
          <OPTION value=>Logged in</OPTION>
          <OPTION value=>IP</OPTION>
        </SELECT> </TD>
      <TD width="80"> <INPUT style="WIDTH: 60px; color:#ffffff; BACKGROUND-COLOR: #990000" type=submit value=Search width="60" name=button></TD>
      <TD width="80"> <INPUT style="WIDTH: 60px; color:#ffffff; BACKGROUND-COLOR: #990000" type=reset value=Clear width="60" name=button></TD>
    </TR>
  </TABLE>
  </P>
</FORM>



</tr>
        <tr bordercolor="#FFFFFF">
          <td height="20" colspan="6" align="right" bordercolor="#990000" bgcolor="#990000">
            <div align="right"><font color="#FFFFFF"><a href="logout.asp">Logout</a></font></div></td>
        </tr>
      </table></td>
  </tr>
</table>
</body>
</html>
<%
end if
%>


In global.asa. the code is:-

<SCRIPT LANGUAGE=VBScript RUNAT=Server>

Sub Session_OnStart      
      Session.Timeout = 1
      Session("Start") = Now
      Application.Lock
      Application("visits") = Application("visits") + 1
      intTotal_visitors = Application("visits")
      Application.Unlock
      Session("VisitorID") = intTotal_visitors
      Application.Lock
      Application("Active") = Application("Active") + 1
      Application.Unlock
End Sub


Sub Session_OnEnd
      session("sessionname") = ""
      Application.Lock
      Application("Active") = Application("Active") - 1
      Application.Unlock
End Sub


the error is:-

Script error detected at line 26.
Source line: <%
Description: Expected statement

you don't need to include global.asa in any file.

remove that line (<!--#include file="global.asa"-->) and see if the error comes up again

global.asa is a global file to the application.  as soon as someone requests a page on your site, global.asa executes, then the your page executes.

The session is not being set back to "" what could be the problem

Couldn't the code just be: -

Sub Session_OnStart    
     Session.Timeout = 1
     Session("Start") = Now
End Sub

Sub Session_OnEnd
     session("sessionname") = ""
End Sub

for what i need it to do

you will have to change session("sessionname") = "" to the session variable you wish to clear.

also:
Accepted Answer from kevp75
Date: 04/05/2006 09:21AM PDT
Grade: A
 Accepted Answer  


you can do this with a global.asa file

you would use something similar to this

Sub Session_OnEnd
   session("sessionname") = ""
End Sub

now..there is a problem to this.   Problem is, if the user closes the window, goes to another page, or their computer freezes on them, session("sessionname") will not get set to "" unless the session timeout occurs.

Best bet is to use some kind of javascript to detect if the user has clicked the X, or hit ALT-F4, then use some autoclosing popup to set session("sessionname") = ""

Or.....you could lower you session timeout in your server.  Problem is with this is what if you have a user logged in to the site longer than your timeout.....

Personally, I wold nix the whole session variable idea, and just use cookies.  if you set no expiry on the cookie, it is only valid until that user closes the browser.  If security is an issue, set the cookie using some kind of encryption, and where you need to get the value from the cookie, decrypt it.

To set a cookie use:response.cookies("cookiename") = value
to get a cookie use:variable = request.cookies("cookiename")

HTAH

I have changed session name to user name but still nothing how do i know iif the global.asa file is running

sorry but also could this code be used in the header instead of a global.asa. file

it could luke, but you also have to realize that you will need to make some serious changes to the application.

If I'm not mistaken you are building something to track your users?
in which case all that other stuff would have to stay, as it is what is going to be keeping count for you of who is logged in or out, and when they logged out and/or in.

Also, unless you change all your pages that reference Application("connString"), they will all fail, because this Application variable (your database connection string) is no longer being set where it needs to be.  Now, you can go and remove it, but as I said, you would need to go into every page that calls for it, and replace the Application("connString") with the actuall connection string for the database.

everytime a person browses to your site, that file is run.

Yes you could put some code in a header.asp file to do the work you need it to do, but you would have to code it differently than what you have.  but then you would have to go into every file and make sure it is included

do me a favor.put this in your page:
response.write("username") & "_" & Session("MM_Username")

and see what it puts out

The application tracks students. However it is only the admin who i want to have security. The student tracking just logs the students login time, user name and IP. The admin then logs in on a different login and can view these details. This all works but the admin needs to be secure. This is were the problem is if the admin doesn't log out and the sesion is stored a student could view th details.

so then the rest of that code you removed will have to stay in global.asa, just like I said it would need to.

All that Application("Active") + 1 stuff is doing all the counting for you

I don't need that tracked and it was removed from the database. It now only records the users ID, login time and IP I do not need to know who is online.

The application works without the global.asa file.

ok, then take it out.
AS I SAID BEFORE:
without:Application("connString") = "Driver={Microsoft Access Driver (*.mdb)};Dbq=C:\Inetpub\wwwroot\online_Users\Online.mdb;Uid=Admin;Pwd=pass;"
 in it you will have to go through every one of your files, and make sure to update every instance of Application("connString"), otherwise the whole application will fail.


AND:
now..there is a problem to this.   Problem is, if the user closes the window, goes to another page, or their computer freezes on them, session("sessionname") will not get set to "" unless the session timeout occurs.

Best bet is to use some kind of javascript to detect if the user has clicked the X, or hit ALT-F4, then use some autoclosing popup to set session("sessionname") = ""

Or.....you could lower you session timeout in your server.  Problem is with this is what if you have a user logged in to the site longer than your timeout.....

Personally, I wold nix the whole session variable idea, and just use cookies.  if you set no expiry on the cookie, it is only valid until that user closes the browser.  If security is an issue, set the cookie using some kind of encryption, and where you need to get the value from the cookie, decrypt it.

To set a cookie use:response.cookies("cookiename") = value
to get a cookie use:variable = request.cookies("cookiename")

Okay the cookie idea seems the best as security is not that important.

that's probably your best bet., just go and replace:
session("username") = usersname '(setting the session variable)

with:
response.cookies("username") = usersname  '(setting the cookie)

and where you would:
usersname = session("username")  '(requesting the session variable)

replace it with:
usersname = request.cookies("username")   '(requesting the cookie)

Q4U:  before you switch to cookies

yes

I noticed in some code that there is: Session("MM_Username")

have you tried to replacing your session("username") with Session("MM_Username")???

I could however when you logout the session returns "" the MM_userNAME I think is to do with dream weaver i will give it a go. but the cookies seems like a great alternative and easy to implement.

it is relatively easy.  I usually only use cookies, and if I need some added security on them, I use an encryption function

I don't think i will but i'm not finding it that easy

what is wrong here should it be<>

<%
if usersname = request.cookies("username")
     Response.Redirect("adminlogin.asp?error=2")
else
%>
<html>
<Head>
<link href="css/css.css" rel="stylesheet" type="text/css">
<style type="text/css">
<!--

div.test {
     width: 500px;
     height:300px

<%
if usersname = request.cookies("username")
     Response.Redirect("adminlogin.asp?error=2")
else
%>

should be

<%
if request.cookies("username") = ""
     Response.Redirect("adminlogin.asp?error=2")
else
%>

For the logout what is the best way to clear the cookie, at the moment it clears session by:-

<%
Session.Abandon()
Session.Contents.RemoveAll()
response.redirect("adminlogin.asp")
%>

replace it with:

<%
request.cookies("username") = ""
response.rediret("adminlogin.asp")
%>

I get this error:-

Script error detected at line 1.
Source line: request.cookies("username") = ""
Description: Type mismatch: 'request.cookies'

sorry bout that....should be response.cookies("username") = ""

Last problem the cookie is being stored as when you logout you are able to click on the back button.

you will have to add:

<%
Response.Expires = -1
%>

to each page.  what is happening there is the previous page is cached.  using this response.expires = -1 will prevent that page from being cached

Okay i think everything is working now. Thanks for all your help you are truly an generous expert. I am going to leave full testing till 2moz as i will not go to sleep knowing something is not working. Thanks again luke

:)

np