Member Avatar for Hellodear

Hello,
I am in the way to make a login page for my new website. It must be a database driven login page.

details:
fields: username, password
database: MS Access

the guest who registering with these field; result must gone to database. so login is in compare with the above said database..

I hope somebody can help me.....

  • 4 Contributors
  • 3 Replies
  • 104 Views
  • 5 Months Discussion Span
  • Latest Post Latest Post by SheSaidImaPregy

Dani AI

Generated

A few focused, practical points to make the Classic ASP + Access login safe and maintainable — building on the directions from , and the sample from .

Do the basics, but do them securely. Keep registration separate from login, store a single user record per account, and never write plaintext passwords to the database. Use a per-user salt plus a modern password hashing algorithm (bcrypt/PBKDF2/Argon2). If you must stay on Classic ASP, call a small COM/.NET helper that performs PBKDF2/SHA-256 with iterations rather than rolling your own string replacements. OWASP’s Password Storage Cheat Sheet explains the requirements in detail: Password Storage Cheat Sheet.

Authenticate by selecting the stored hash and salt for the supplied username (use parameterized queries), compute the hash of the supplied password on the server, then compare. Don’t put username+password into a concatenated SQL string — use an ADODB.Command with parameters to prevent SQL injection and avoid ad-hoc “strip characters” sanitizers. Example (fetch only, then verify hash server-side):

<%
Dim conn, cmd, rs, username
username = Trim(Request.Form("txtUser"))
Set conn = Server.CreateObject("ADODB.Connection")
conn.Open "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath("/data/users.mdb") & ";"
Set cmd = Server.CreateObject("ADODB.Command")
Set cmd.ActiveConnection = conn
cmd.CommandText = "SELECT UserID, PasswordHash, PasswordSalt FROM Users WHERE UserName = ?"
cmd.CommandType = 1
cmd.Parameters.Append cmd.CreateParameter("pUser", 200, 1, 50, username)
Set rs = cmd.Execute()
' if rs not EOF then compute hash(Request.Form("txtPassword"), rs("PasswordSalt")) and compare
%>

Operational cautions: put the .mdb/.accdb outside the webroot, grant only the IIS account the minimum file permissions needed, and be aware Access does not scale well for many concurrent writes (consider SQL Server Express when you grow). Regenerate the session id at login, set short timeouts, use HTTPS and Secure/HttpOnly cookies, implement simple throttling/lockout for repeated failures, and avoid revealing whether a username exists. For SQL injection background, see OWASP: SQL Injection.

Recommended Answers

All 3 Replies

Member Avatar for bsvnhll

Create the database that should contains following fields
UserId,Username, password and some othere details of the user. Make UserId as Primarykey in the database.

Design Login page. mach the login user with the username and password using simple coditions if valid allow him inside other wise give message to him.
if the login user is new user provide the interface such that he can provide his infomation. and store the information in the same table.

Member Avatar for david_123

If it is new user he must go to registeration page as well to store his or her information

thanks
www.globalsoftsols.com

Create the database that should contains following fields
UserId,Username, password and some othere details of the user. Make UserId as Primarykey in the database.

Design Login page. mach the login user with the username and password using simple coditions if valid allow him inside other wise give message to him.
if the login user is new user provide the interface such that he can provide his infomation. and store the information in the same table.

Member Avatar for SheSaidImaPregy

Your best bet is to pull some information out of the database to see if a user exists with your currently supplied information from the user. Use an sql query like the one below, with the code below:

<%
  Response.Buffer = true
  Session("DatabasePath") = "Path to your database, put it here. rest will fill in for you"
  If Request.Form("btnLogin") = "Login" AND Request.Form("txtUserName") <> "" AND Request.Form("txtPassword") <> "" Then

    Dim conn, strSQL, rs

    strUserName = MakeSQLSafe(Trim(Request.Form("txtName")))
    strPassword = MakeSQLSafe(Trim(Request.Form("txtPassword")))

    Set conn = Server.CreateObject("ADODB.Connection")
    conn.Open "DRIVER={Microsoft Access Driver (*.mdb)};DBQ=" & Session("DatabasePath") & ";"

    strSQL = "SELECT UserName, UserID FROM Users WHERE UserName='" & strUserName & "' AND UserPassword='" & strPassword & "'"

    Set rs = Server.CreateObject("ADODB.Recordset")
    rs.Open strSQL, , 0, 2

    If Not rs.EOF Then
      Session("logged") = 1
      Session("UserName") = rs("UserName")
      Session("UserID") = rs("UserID")
    Else
      Response.Redirect ("register.asp?login=failed")
    End If
    rs.Close()
    conn.Close()
    set rs = nothing
    set conn = nothing
  Else
    response.redirect ("login.asp?fields=null")
  End If
  
  Function MakeSQLSafe(sender)
    sender = Replace(sender, ";", "")
    sender = Replace(sender, """", "")
    sender = Replace(sender, "'", "")
    sender = Replace(sender, "''", "")
    Return(sender)
  End Function
%>
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.