prolbems with site password protection

[tom4stir]

I am kink of new wilth html, and I like to use http://www.javascriptkit.com/ alot. But there is one think that is kink of weird and I can't get to work how I want to.

The html I am having troulble with is something that puts a password on to your site so you need a password to access it. I got that working fine, but when I have it link to the site, after you enter the correct password, it will only link to the site that is hosting me /what even it put to link to. Example, of geocities if hosting me, and in the html I put it to link to cnn.com after you put the correct password, it would link to www.geocities.com/username/cnn.com.

Does anyone know how to stop it from doing this?

Thanks :confused:

[Galdo]

Can't tell really without you posting some code.

[tom4stir]

<SCRIPT>
function passWord() {
var testV = 1;
var pass1 = prompt('Please Enter Your Password',' ');
while (testV < 3) {
if (!pass1)
history.go(-1);
if (pass1.toLowerCase() == "letmein") {
alert('You Got it Right!');
window.open('protectpage.html');
break;
}
testV+=1;
var pass1 =
prompt('Access Denied - Password Incorrect, Please Try Again.','Password');
}
if (pass1.toLowerCase()!="password" & testV ==3)
history.go(-1);
return " ";
}
</SCRIPT>
<CENTER>
<FORM>
<input type="button" value="Enter Protected Area" onClick="passWord()">
</FORM>
</CENTER>

[dominicall]

Not really sure of the answer to your question but thought I'd just pass on a comment...

With your password visible in the javascript it is possible for anyone who views the page source to see the password and get in.

You're better off storing the password in a database and passing the entry from the password field to a server side script that checks the password which then sends back true/false depending whether the password matches or not.

You can then set either a session variable or cookie (whichever) to maintain the login state until you log out, when either the session variable is cancelled or the cookie deleted/set to logged-out.

Will be much more secure than the javascript way.

Dominic

[Simrey]

You need to specifiy the full url of the document, thus

code... code...

window.open('http://domain.com/any/directories/protectpage.html',etc)
... rest of code...

Without the full or absolute url to tell it where to find the document it just looks in the directory of the current document.

Does that help? Or have I misunderstood the problem?


Simon