I have always thought this was a good idea until last week when our DBA
pointed out that if a web site can send you a forgotten password it means
your password isn't stored encrypted on the server. Or if it is they have a
simple means to unencrypted. Which means a bad guy or gal DBA could get
peoples passwords.  

The above aside, it depends on what type of information you are keeping on
the user. For example, if you have it set up so that the login name is the
persons email address then it seems like all you have to do is ask for the
email address and email the password associated with the email address to
the address. Or like someone else mentioned if you keep a 'hint' you could
compare the login name and hint against the database to get the password. 

Mike 


-----Original Message-----
From: Lance Kirby [mailto:lkirby@g...]
Sent: Tuesday, June 11, 2002 6:04 PM
To: ASP Web HowTo
Subject: [asp_web_howto] Forgot Password Button


Can any one help me in getting a script started.  I need help in getting 
a forgot password button started so that my customers can retrieve their 
password from a sql server 2000 database that stores their user 
information.  Any ideas would be help full

---

Improve your web design skills with these new books from Glasshaus.

Usable Web Menus
http://www.amazon.com/exec/obidos/ASIN/1904151027/ref=nosim/theprogramme
r-20
Constructing Accessible Web Sites
http://www.amazon.com/exec/obidos/ASIN/1904151000/ref=nosim/theprogramme
r-20
Practical JavaScript for the Usable Web
http://www.amazon.com/exec/obidos/ASIN/1904151051/ref=nosim/theprogramme
r-20

get the user to provide some other info, such as an email or username and 
then check this against the DB, if there is a match, mail the address you 
have for the user with the password.

At 22:04 11/06/02 +0000, you wrote:
>Can any one help me in getting a script started.  I need help in getting
>a forgot password button started so that my customers can retrieve their
>password from a sql server 2000 database that stores their user
>information.  Any ideas would be help full
>
>---
>
>Improve your web design skills with these new books from Glasshaus.
>
>Usable Web Menus
>http://www.amazon.com/exec/obidos/ASIN/1904151027/ref=nosim/theprogramme
>r-20
>Constructing Accessible Web Sites
>http://www.amazon.com/exec/obidos/ASIN/1904151000/ref=nosim/theprogramme
>r-20
>Practical JavaScript for the Usable Web
>http://www.amazon.com/exec/obidos/ASIN/1904151051/ref=nosim/theprogramme
>r-20

Have a text box for the user to input their ID.  Then
place a button like this:

<input type="button" name="Get Password" value="Get
Password" onClick="GetPW();">

Use this function in javascript:

function GetPW(){

window.open('ShowPW.asp?id=' +
document.form1.ID.value);

}

Then, on ShowPW.asp, have code to get the ID from the
querystring and hit the database with:

SQLstr = "select UserPassword
from Table
where ID = " & request.quersystring("id")

Then show your results.

It's not complete, but hopefully you can get the idea.

Mark




--- Lance Kirby <lkirby@g...> wrote:
> Can any one help me in getting a script started.  I
> need help in getting 
> a forgot password button started so that my
> customers can retrieve their 
> password from a sql server 2000 database that stores
> their user 
> information.  Any ideas would be help full
> 
> ---
> 
> Improve your web design skills with these new books
> from Glasshaus.
> 
> Usable Web Menus
>
http://www.amazon.com/exec/obidos/ASIN/1904151027/ref=nosim/theprogramme
> r-20
> Constructing Accessible Web Sites
>
http://www.amazon.com/exec/obidos/ASIN/1904151000/ref=nosim/theprogramme
> r-20
> Practical JavaScript for the Usable Web
>
http://www.amazon.com/exec/obidos/ASIN/1904151051/ref=nosim/theprogramme
> r-20


__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

Can any one help me in getting a script started.  I need help in getting 
a forgot password button started so that my customers can retrieve their 
password from a sql server 2000 database that stores their user 
information.  Any ideas would be help full