ASP Question

User authentication through email to the webmaster

[brett2_UMBC]

Hello. What I'd like to do, is to have the ASP script actually email me with the username, email address, and full name of the person who wants membership, and then, let me allow it. I don't know how I would be able to do this using ASP. I can write to the access DB fine, but now I want to restrict the access some more, and actually see who wants to join the page, and upon my authorization, allow them access.

I guess it's like suspending their username and password until they click an authorization link which I send them. Anyone have an idea of where to look of a good ASP script, or know how to do it in Dreamweaver MX, or know how to do it? Any help would be nice.

[defanjos]

All you have to do is add a field called "Active" to the DB, when people signup, the field is by default "False", then if you want them to have full access, change the field to "True".

After they login, the ASP page can check if Active = true, and if it does, give them full access.

[brett2_UMBC]

Where would this If Then statement go? I've added a field in my DB called Active. Two people are True and the default value is false. What should the statement look like?
Here's my script as it is so far for a regular login:

<%@LANGUAGE="VBSCRIPT"%> 
<!--#include file="Connections/umbcems.asp" -->
<%
' *** Validate request to log in to this site.
MM_LoginAction = Request.ServerVariables("URL")
If Request.QueryString<>"" Then MM_LoginAction = MM_LoginAction + "?" + Request.QueryString
MM_valUsername=CStr(Request.Form("username"))
If MM_valUsername <> "" Then
 MM_fldUserAuthorization=""
 MM_redirectLoginSuccess="members/index.asp"
 MM_redirectLoginFailed="login_error.asp"
 MM_flag="ADODB.Recordset"
 set MM_rsUser = Server.CreateObject(MM_flag)
 MM_rsUser.ActiveConnection = MM_umbcems_STRING
 MM_rsUser.Source = "SELECT user_name, password"
 If MM_fldUserAuthorization <> "" Then MM_rsUser.Source = MM_rsUser.Source & "," & MM_fldUserAuthorization
 MM_rsUser.Source = MM_rsUser.Source & " FROM user_pass WHERE user_name='" & Replace(MM_valUsername,"'","''") &"' AND password='" & Replace(Request.Form("pass"),"'","''") & "'"
 MM_rsUser.CursorType = 0
 MM_rsUser.CursorLocation = 2
 MM_rsUser.LockType = 3
 MM_rsUser.Open
 If Not MM_rsUser.EOF Or Not MM_rsUser.BOF Then 
 ' username and password match - this is a valid user
 Session("MM_Username") = MM_valUsername
 If (MM_fldUserAuthorization <> "") Then
 Session("MM_UserAuthorization") = CStr(MM_rsUser.Fields.Item(MM_fldUserAuthorization).Value)
 Else
 Session("MM_UserAuthorization") = ""
 End If
 if CStr(Request.QueryString("accessdenied")) <> "" And true Then
 MM_redirectLoginSuccess = Request.QueryString("accessdenied")
 End If
 MM_rsUser.Close
 Response.Redirect(MM_redirectLoginSuccess)
 End If
 MM_rsUser.Close
 Response.Redirect(MM_redirectLoginFailed)
End If
%>

The database is ems_logins.mdb
The Data Source Name is umbcems

Thanks for the help.

~Brett

[defanjos]

I think all you have to do is this:

MM_rsUser.Source = "SELECT user_name, password, active"
If MM_fldUserAuthorization <> "" Then MM_rsUser.Source = MM_rsUser.Source & "," & MM_fldUserAuthorization
MM_rsUser.Source = MM_rsUser.Source & " FROM user_pass WHERE active = true AND user_name='" & Replace(MM_valUsername,"'","''") &"' AND password='" & Replace(Request.Form("pass"),"'","''") & "'"

[brett2_UMBC]

---------------------------------------------

MM_rsUser.Source = "SELECT user_name, password, active" 
If MM_fldUserAuthorization <> "" Then MM_rsUser.Source = MM_rsUser.Source & "," & MM_fldUserAuthorization 
MM_rsUser.Source = MM_rsUser.Source & " FROM user_pass WHERE active = true AND user_name='" & Replace(MM_valUsername,"'","''") &"' AND password='" & Replace(Request.Form("pass"),"'","''") & "'"

---------------------------------------------

I tried that and it doens't seem to check it. It lets me right through even though I have "false" in the active field. Wonder what else could be wrong.

Thanks for the help though.

[brett2_UMBC]

I have this email script:

<%
Dim strName, strEmail, strUsername, strPass
strName = Request.Form("name")
strEmail = Request.Form("email")
strUsername = Request.Form("username")
strPass = Request.Form("password")
Dim objMail
Set objMail = CreateObject("CDONTS.NewMail")
With objMail
 .From = strName & (strEmail)
 .To = "[e-mail]"
 .Subject = strSubject
 .Body = "Sent By: " & strName & chr(13) & "Email Address: " & strEmail & chr(13) & chr(13) & "Username: " & chr(13) & strUsername & chr(13) & "Password: " & chr(13) & strPass & "======================================================" & chr(13) & Date() & " at " & Time()
 .Send
End With
Set objMail = Nothing
%>

Can't I just insert this in the head as well as the insert and check scripts for the add_member.asp page?

Any help you can offer would be great.

~Brett

[edited by: brett2_UMBC at 2:32 am (utc) on April 19, 2003]

[defanjos]

brett2_UMBC,

Which is the DataType on the field "Active"?
It has to be Yes/No for the code to work, if it is "Text" it won't work, you have to use --> active = '"& true &"'

[brett2_UMBC]

Ok. I changed the DataType to Yes/No. I now get an error message of:

Error Type:
Microsoft OLE DB Provider for ODBC Drivers (0x80040E07)
[Microsoft][ODBC Microsoft Access Driver] Data type mismatch in criteria expression.
/umbcems/login.asp, line 21

I think it has to do with the code I changed.

Old:

MM_rsUser.Source = MM_rsUser.Source & " FROM user_pass WHERE active = true AND user_name='" & Replace(MM_valUsername,"'","''") &"' AND password='" & Replace(Request.Form("pass"),"'","''") & "'"

New:

MM_rsUser.Source = MM_rsUser.Source & " FROM user_pass WHERE active ='" & true &"' AND user_name='" & Replace(MM_valUsername,"'","''") &"' AND password='" & Replace(Request.Form("pass"),"'","''") & "'"

Thanks for the help, we're gettin there I think.

~Brett

[defanjos]

Brett,

I think you misunderstood me, if you do yes/no, you have to use:

MM_rsUser.Source = MM_rsUser.Source & " FROM user_pass WHERE active = true AND user_name='" & Replace(MM_valUsername,"'","''") &"' AND password='" & Replace(Request.Form("pass"),"'","''") & "'"

If you do "text", you have to use:
MM_rsUser.Source = MM_rsUser.Source & " FROM user_pass WHERE active ='"& true &"' AND user_name='" & Replace(MM_valUsername,"'","''") &"' AND password='" & Replace(Request.Form("pass"),"'","''") & "'"

[defanjos]

One more thing, if this does not work -> active ='"& true &"', try this -> active ="& true &"

[brett2_UMBC]

That worked great, (the first one). Thanks.

Now, could anyone answer this question:
[webmasterworld.com ]

~Brett