Sorry about the language. It's dutch. Early, quick and dirty work and that stuf. At the bottom, theres some cleaner code for for an other app. (english) Maybe easier that way
OK.
meta : just ignore that. It's some stuff my editor slips in when i create a new page. It just gives info on the page. Nothning to do with the code.
Basically, what happens is this. I validate the user ID and password. If this is ok, i store the profile of that user into a sessionvariable. I get the profile from the recordset that was used to select the password for that user.
(in this case named as rsLogin.Fields("profile"))
So this sessionvariable can now be used to determine if a user is permitted to open a page. Or, within a page, to determine which links will be in the page that is sent to the client.
what does ("securityprofile") >= 1 and ("securityprofile") >=2 do? Are u checking 2 things?
Well, on that page there was sort of a menu. Some links to different module. I check the value of the sessionvariable, and if it is high enough, i display the link. You can do this for each link. (on top of each of these page where the links point to, i again check the sessionvariables value). You can even apply different layout based on the profile. But the check is always on the same vsessionvariable.
NOTE : in the code below, is also set a sessionvariable (logonadmin) as an extra cause the regular site also had a profilecheck thingy and i didn't want to risk people being able to login to the admin-part cause someone gave them a wrong profilevalue)
Let me know if you got other questions/problems
<%
Dim user, password
password=request.form("password")
user=request.form("user")
if len(user) = 0 then
response.write("<font color='red'>Please enter your username.<br><br></font>")
response.write("<a href='javascript:history.back();'>Back</a>")
else
if len(password) = 0 then
response.write("<font color='red'>Pleas enter your pasword.<br><br></font>")
response.write("<a href='javascript:history.back();'>Back</a>")
else
%>
<!--#include file='conadmin.inc'-->
<%
dim rsLogin
set rsLogin = server.CreateObject("adodb.recordset")
dim sql
sql="select user_id, user_name, user_password, profile from users where user_name='loginuser'"
sql=replace(sql,"loginuser",user)
rsLogin.Open sql, conadmin
if rsLogin.EOF=true then
Response.Write("<font color='red'>Your username is incorrect.</font>")
response.write("<br><br><a href='javascript:history.back();'>Back</a>")
else
if password <> rsLogin.Fields("user_password") then
session("logintrys")= session("logintrys") + 1
if session("logintrys") < 3 then
response.write("<font color='red' size='15'>Your password is incorrect.Remember that paswords are 'case sensitive'.</font>")
response.write("<br><br><a href='javascript:history.back();'>Back</a>")
else
response.write("<font color='red' size='15'>You entered three incorrect passwords. You can not proceed.</font>")
response.write("<br><br><a href='javascript:window.close();'>Exit</a>")
end if
else
session("logintrys")="0"
session("logonadmin")=2
session("profile")=rsLogin.Fields("profile")
response.redirect("adminmain.asp")
end if
end if
rsLogin.Close
conadmin.Close
set rsLogin=nothing
set conadmin = nothing
end if
end if
%>