login script for ASP

**RFH Reseller: Space Cowboy** · 19th March 2008, 04:02 PM

right ive at my witts end!

Does anyone have or can show me the right direction...
I need a login script using ASP that will select a user from a MySQL database based upon the username and password they enter into a form. Then it will write their details to a cookie.

Thats something fairly simple- but you would be shocked at how hard it is to find this on google!

any help would be massivley appricated!
Why does ASP have to exisit?! why cant everything be PHP?!

**RFH Reseller: Rappie** · 19th March 2008, 05:50 PM

I love ASP

(altough PHP is nice too.)

This some code i used some years go for a website. It doenst use cookies, but sessions instead. Won't be to hard to change the script and use cookies (or both).

Code:

<%
If Request.Form("btnLogin") = "Login" AND Request.Form("txtName") <> AND Request.Form("txtPassword") <> "" Then
    '-- Declare your variables
    Dim objDBConn, cmdDC, RecordSet
    Dim RecordToEdit, Updated, strUserName, strPassword
 Dim strUserIP 
 
 strUserName = Request.Form("txtName")
 strUserName = Replace(strUserName,"\","\\")
 strUserName = Replace(strUserName,"'","\'")
 strPassword = Request.Form("txtPassword")
 strPassword = Replace(strPassword,"\","\\")
 strPassword = Replace(strPassword,"'","\'")

 Session("userName") = strUserName
    '-- Create object and open database
    Set objDBConn = Server.CreateObject("ADODB.Connection")
    objDBConn.Open "Driver={MySQL ODBC 3.51 Driver}; Server=server_name; Database=db_name; UID=user_name; PWD=password"
 strUserIP = Request.ServerVariables("REMOTE_ADDR")
 strSQL = "SELECT ip FROM ip_ban WHERE ip = '" & strUserIP & "'"
 Set rs = objDBConn.Execute(strSQL)
 If Not rs.EOF then
  Session("UserAuth") = "ban"
 End If
 Set rs = Nothing
    Set cmdDC = Server.CreateObject("ADODB.Command")
    cmdDC.ActiveConnection = objDBConn
    '-- default SQL
    SQL = "SELECT * FROM members"
    If Request.Form("txtName") <> "" Then 
  SQL = "SELECT members.* FROM members " & _
        " WHERE members.userID ='" & strUserName & _
        "' AND members.password ='" & strPassword & ";"
    End If
    cmdDC.CommandText = SQL
    Set RecordSet = Server.CreateObject("ADODB.Recordset")
    '-- Cursor Type, Lock Type
    '-- ForwardOnly 0 - ReadOnly 1
    '-- KeySet 1 - Pessimistic 2
    '-- Dynamic 2 - Optimistic 3
    '-- Static 3 - BatchOptimistic 4
    RecordSet.Open cmdDC, , 0, 2

 If Not RecordSet.EOF Then
    Dim struserLevel
    struserLevel = RecordSet.Fields("userLevel")
    Session("userLevel") = struserLevel
 Else
    'The user was not validated...
    'Take them to a page which tells them they were not validated...
     Response.redirect "/?error=logon_nok"
 End If
End If
 
'Close some stuff, to prevent errors
Set cmdDC = Nothing
Set RecordSet = Nothing
'
If Session("userLevel") = "member" AND Session("userName") <> "" OR Session("userLevel") = "admin" AND Session("userName") <> "" Then
'Content goes here
Else
 Response.redirect "/?error=logon_nok"
End If
%>

It uses a database table called members, with the following fields: userID, password, userLevel, UserAuth (= IP the users IP adres).

Hope it helps moving in the right direction