|
Password protection for certain
areas of your website
Many people want to "password protect" their website.
There are a few ways to do this: Java script (not very secure if a basic
script), text file (not bad, but is a flat file and cannot handle many users) or
an .asp database page.
Since we are most concerned about
web databases in this article we would assume that you would be using an .asp
solution. Either Access or SQL work; both populate data to a table.
The only difference is the number of users each program can handle at the same
time.
An .asp solution also normally
includes a cookie; which is why "cookies must be
enabled" to view most database
driven sites, no cookie; no value to
query, therefore no results.
The input from the text box and
creates a "session variable". This unique identifier can then be
used to query the database to display dynamic content
personalized for each viewer. Here's an example: yourdomain.cam/database/seemyprofile.asp?userID=<%=user_name%>
In the above example
someone would login and want to see their profile. They would click on
this link that would display results on the seemyprofile.asp page, sorted by
their user name, which is taken from the "session variable" that was
created when they first logged in.
In most cases it is good to use pre-made or "canned" scripts for this type of
functionality. By hunting around you can find some decent free scripts, or
for more powerful code you can pay anywhere from $15-300.00.
Why would you pay money for this
type of script? Well, the more advanced ones have additional functionality
which can be very handy, things like:
-
Confirm that there is only 1
user logged in with those credentials
-
Count the number of times or
frequency of logins by user
-
More robust security features
and URL hashing
Sometimes
it makes sense to pay a bit of money for
a good quality script. Like
always we feel you get what you pay for....
If you decide you want to code one
by yourself you will need:
-
A registration page. This populates
the database
-
A "bad login" page.
This is your "bounce page", No soup for
you...
-
A "login" page. Enter
your user ID and password.
-
A "checklogin" page and
a "shared" page which checks the database and sets a
cookie. These pages are the backend of the application and not seen by
the visitor.
-
A Welcome to the website, you have
authenticated!!" page.
Normally:
* You see the registration page, and enter you information.
* You register successfully and then have to login again (sometimes upon successful
login an email is sent that you must respond to before your listing is active).
* You login, but before you see another page behind the scenes the server consults the checklogin and shared.asp files.
If both are present and credentials are valid you then see the welcome page.
* Now that you are on a welcome page and successfully logged in you can
query the database, usually using the "session variable" tag" Example:
yourdomain.cam/database/seemyprofile.asp?userID=<%=user_name%>
To password protect a new page in the same
folder you add an "include" at the top of the page, above the HTML tag, similar to the
following example:
<!--#include file="shared.asp" -->
<!--#include file="checklogin.asp" -->
|
