login issue. using asp and access

teknet · January 16th, 2005, 07:13 PM

i'm unable to login to the admin page, i setup admin/admin for user and pass in a access db, but is not checking with the db that i setup. I'm able to write to it with no problem 'cause i use the register page to create a new user and i check the db and the user was created.

Here is my dsn connection string.
(conn.asp)
<%
'FileName="Connection_ado_conn_string.htm"
'Type="ADO"
'DesigntimeType="ADO"
'HTTP="false"
'Catalog=""
'Schema=""
Dim MM_conn_STRING,Title
MM_conn_STRING = "dsn=iHomes;Uid=;Pwd=;"
Title= "::RSN::"
%>
HERE is my admin login page.
(default.asp)
<%@LANGUAGE="VBSCRIPT"%>

<%
' *** Validate request to log in to this site.
MM_LoginAction = Request.ServerVariables("URL")
If Request.QueryString<>"" Then MM_LoginAction = MM_LoginAction + "?" + Request.QueryString
MM_valUsername=CStr(Request.Form("Username"))
If MM_valUsername <> "" Then
MM_fldUserAuthorization="ACCESS"
MM_redirectLoginSuccess="rads.asp"
MM_redirectLoginFailed="loginFailed.asp"
MM_flag="ADODB.Recordset"
set MM_rsUser = Server.CreateObject(MM_flag)
MM_rsUser.ActiveConnection = MM_conn_STRING
MM_rsUser.Source = "SELECT U_ID, U_PASSWORD"
If MM_fldUserAuthorization <> "" Then MM_rsUser.Source = MM_rsUser.Source & "," & MM_fldUserAuthorization
MM_rsUser.Source = MM_rsUser.Source & " FROM USERS WHERE U_ID='" & Replace(MM_valUsername,"'","''") &"' AND U_PASSWORD='" & Replace(Request.Form("Password"),"'","''") & "'"
MM_rsUser.CursorType = 0
MM_rsUser.CursorLocation = 2
MM_rsUser.LockType = 3
MM_rsUser.Open
If Not MM_rsUser.EOF Or Not MM_rsUser.BOF Then
    ' username and password match - this is a valid user
    Session("MM_Username") = MM_valUsername
    If (MM_fldUserAuthorization <> "") Then
     Session("MM_UserAuthorization") = CStr(MM_rsUser.Fields.Item(MM_fldUserAuthorization ).Value)
    Else
     Session("MM_UserAuthorization") = ""
    End If
    if CStr(Request.QueryString("accessdenied")) <> "" And true Then
     MM_redirectLoginSuccess = Request.QueryString("accessdenied")
    End If
    MM_rsUser.Close
    Response.Redirect(MM_redirectLoginSuccess)
End If
MM_rsUser.Close
Response.Redirect(MM_redirectLoginFailed)
End If
%>
<%
' *** Logout the current user.
MM_Logout = CStr(Request.ServerVariables("URL")) & "?MM_Logoutnow=1"
If (CStr(Request("MM_Logoutnow")) = "1") Then
Session.Abandon
MM_logoutRedirectPage = "default.asp"
' redirect with URL parameters (remove the "MM_Logoutnow" query param).
if (MM_logoutRedirectPage = "") Then MM_logoutRedirectPage = CStr(Request.ServerVariables("URL"))
If (InStr(1, UC_redirectPage, "?", vbTextCompare) = 0 And Request.QueryString <> "") Then
    MM_newQS = "?"
    For Each Item In Request.QueryString
     If (Item <> "MM_Logoutnow") Then
        If (Len(MM_newQS) > 1) Then MM_newQS = MM_newQS & "&"
        MM_newQS = MM_newQS & Item & "=" & Server.URLencode(Request.QueryString(Item))
     End If
    Next
    if (Len(MM_newQS) > 1) Then MM_logoutRedirectPage = MM_logoutRedirectPage & MM_newQS
End If
Response.Redirect(MM_logoutRedirectPage)
End If
%>

<%
Dim rsUser__MMColParam
rsUser__MMColParam = "1"
if (Session("MM_Username") <> "") then rsUser__MMColParam = Session("MM_Username")
%>
<%
set rsUser = Server.CreateObject("ADODB.Recordset")
rsUser.ActiveConnection = MM_conn_STRING
rsUser.Source = "SELECT * FROM USERS WHERE U_ID = '" + Replace(rsUser__MMColParam, "'", "''") + "'"
rsUser.CursorType = 0
rsUser.CursorLocation = 2
rsUser.LockType = 3
rsUser.Open()
rsUser_numRows = 0
%>

<html>
<head>
<title><%=title%></title>

<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<link href="../css/style_sheet_core.css" rel="stylesheet" type="text/css">
</head>
<body background="" text="#000000" leftmargin="3" topmargin="4" marginwidth="0" marginheight="0">
<br>
<table width="780" height="450" border="0" align="center" cellpadding="0" cellspacing="8" background="../img/intro.jpg">
<tr>
    <td width="764" height="450" valign="middle"> <table width="100%" border="0" cellspacing="8" cellpadding="0">
        <tr>
         <td valign="top"> <br> <br> <br> <br> <br> <br> <br> <br> <br> <br>
            <br> <table width="230" border="1" align="center" cellpadding="4" cellspacing="0" bordercolor="#AEACC3">
             <tr>
                <td valign="top"> <div align="center"> Please
                    login!<br>
                    <form name="LOGIN" method="POST" action="<%=MM_LoginAction%>">
                     <div align="center"><strong>Username:</strong><br>
                        <input name="Username" type="text" class="inputFieldIE" value="" size="15">
                        <br>
                        <strong>Password:</strong> <br>
                        <input name="Password" type="password" class="inputFieldIE" value="" size="15">
                        <br>
                        <input name="imageField" type="image" src="../img/ok.gif" width="34" height="13" border="0">
                     </div>
                    </form>
                 </div></td>
             </tr>
            </table></td>
        </tr>
     </table></td>
</tr>
</table>
<p> </p>
<p> </p>

</body>
</html>
<%
rsUser.Close()
Set rsUser = Nothing
%>

Give a fish to the man and he will eat for a day;Teach him how to fish and he will eat for life.

Imar · January 17th, 2005, 03:56 PM

Are you sure it gets the right values from the database?

Try this:

Code:

If Not MM_rsUser.EOF Or Not MM_rsUser.BOF Then 
    ' username and password match - this is a valid user

Response.Write("Authentication OK")
Response.End
    Session("MM_Username") = MM_valUsername
    If (MM_fldUserAuthorization <> "") Then
      Session("MM_UserAuthorization") = CStr(MM_rsUser.Fields.Item(MM_fldUserAuthorization).Value)
    Else
      Session("MM_UserAuthorization") = ""
    End If
    if CStr(Request.QueryString("accessdenied")) <> "" And true Then
      MM_redirectLoginSuccess = Request.QueryString("accessdenied")
    End If
    MM_rsUser.Close
    Response.Redirect(MM_redirectLoginSuccess)

  End If

  Else
 Response.Write("Authentication Failed")
Response.End
  MM_rsUser.Close

Try this, and then post here what you see on the screen. (Should be OK or Failed).

Cheers,

Imar
---------------------------------------
Imar Spaanjaars
Everyone is unique, except for me.

teknet · January 18th, 2005, 01:16 AM

Authentication Failed

Give a fish to the man and he will eat for a day;Teach him how to fish and he will eat for life.

Imar · January 18th, 2005, 02:55 AM

Right. SO, that means that the authentication code runs successfully and your database is hit, but the required record are not returned.

If you make the following change, you can examine your Sql statement:

Code:

MM_rsUser.LockType = 3
  Response.Write("SQL is " & MM_rsUser.Source & "<br />")
  Response.End
  MM_rsUser.Open
  If Not MM_rsUser.EOF Or Not MM_rsUser.BOF Then

Then try to log in on the page. This displays the Sql statement on screen. COpy it, and then paste in the query designer of your Access database. Do you get the record you're expecting?

Cheers,

Imar
---------------------------------------
Imar Spaanjaars
Everyone is unique, except for me.

teknet · January 20th, 2005, 02:12 PM

ok now i get this SQL is SELECT U_ID, U_PASSWORD,ACCESS FROM USERS WHERE U_ID='admin' AND U_PASSWORD='admin' but i can't use it in query designer in access.

Give a fish to the man and he will eat for a day;Teach him how to fish and he will eat for life.

Imar · January 20th, 2005, 05:24 PM

Can you define "can't use it in query designer in access."

Do you get an error? Please be more specific about the situation and any errors you might get. You have to help us help you.

Cheers,

Imar
---------------------------------------
Imar Spaanjaars
Everyone is unique, except for me.

teknet · January 20th, 2005, 11:37 PM

did what you told me. quote"ok now i get this SQL is SELECT U_ID, U_PASSWORD,ACCESS FROM USERS WHERE U_ID='admin' AND U_PASSWORD='admin' but i can't use it in query designer in access"
and i get U_ID="" and U_PASSWORD="" ALSO ACCESS="user" . The correct data should be U_ID='admin' AND U_PASSWORD='admin' ACCESS="admin"

Give a fish to the man and he will eat for a day;Teach him how to fish and he will eat for life.

teknet · February 8th, 2005, 12:00 AM

Well back again with the same issue that.
the sql statement was tested in access. SELECT U_ID, U_PASSWORD, ACCESS FROM USERS WHERE U_ID='admin' AND U_PASSWORD='admin'; and it was able to pull the record that i was looking for but i still get the login fail page.
here is the code.
<%
' *** Validate request to log in to this site.
MM_LoginAction = Request.ServerVariables("URL")
If Request.QueryString<>"" Then MM_LoginAction = MM_LoginAction + "?" + Request.QueryString
MM_valUsername=CStr(Request.Form("Username"))
If MM_valUsername <> "" Then
  MM_fldUserAuthorization="ACCESS"
  MM_redirectLoginSuccess="rads.asp"
  MM_redirectLoginFailed="loginFailed.asp"
  MM_flag="ADODB.Recordset"
  set MM_rsUser = Server.CreateObject(MM_flag)
  MM_rsUser.ActiveConnection = MM_conn_STRING
  MM_rsUser.Source = "SELECT U_ID, U_PASSWORD"
  If MM_fldUserAuthorization <> "" Then MM_rsUser.Source = MM_rsUser.Source & "," & MM_fldUserAuthorization
  MM_rsUser.Source = MM_rsUser.Source & " FROM USERS WHERE U_ID='" & Replace(MM_valUsername,"'","''") &"' AND U_PASSWORD='" & Replace(Request.Form("Password"),"'","''") & "'"
  MM_rsUser.CursorType = 0
  MM_rsUser.CursorLocation = 2
  MM_rsUser.LockType = 3
  MM_rsUser.Open
  If Not MM_rsUser.EOF Or Not MM_rsUser.BOF Then
    ' username and password match - this is a valid user

    Session("MM_Username") = MM_valUsername
    If (MM_fldUserAuthorization <> "") Then
      Session("MM_UserAuthorization") = CStr(MM_rsUser.Fields.Item(MM_fldUserAuthorization ).Value)
    Else
      Session("MM_UserAuthorization") = ""
    End If
    if CStr(Request.QueryString("accessdenied")) <> "" And true Then
      MM_redirectLoginSuccess = Request.QueryString("accessdenied")
    End If
    MM_rsUser.Close
    Response.Redirect(MM_redirectLoginSuccess)
  End If

  MM_rsUser.Close
  Response.Redirect(MM_redirectLoginFailed)
End If
%>

Give a fish to the man and he will eat for a day;Teach him how to fish and he will eat for life.
[/quote]

Give a fish to the man and he will eat for a day;Teach him how to fish and he will eat for life.

Imar · February 8th, 2005, 03:26 AM

The code looks fine, so I guess you need to find out where it breaks to understand why it breaks.

In the login code, add Response.Write() all over the place and add a Response.End statement at the end. This way, you now where it goes into end or else statements etc.

For example:

If Not MM_rsUser.EOF Or Not MM_rsUser.BOF Then
    ' username and password match - this is a valid user
    Session("MM_Username") = MM_valUsername
    Response.Write("User Found")

It may be so that the code is working fine, but that, for example, your system doesn't allow cookies so your session variables don't "stick".

Cheers,

Imar

teknet · February 9th, 2005, 01:49 AM

the script was right it was a server issue.

Give a fish to the man and he will eat for a day;Teach him how to fish and he will eat for life.