Code Bank
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
 
 
User Name:
Password:
Remember me
Go Back   ASP Free Forums > Programming > Code Bank
Reload this Page

Basic Login Validation

Discuss Basic Login Validation in the Code Bank forum on ASP Free.
Basic Login Validation Code Bank forum containing sample code and scripts to help solve common problems. Take a look and use the code to assist in your projects.

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread ASP Free Forums Sponsor:
  #1  
Old May 3rd, 2007, 08:33 AM
degsy degsy is offline
Contributing User
ASP Free God 2nd Plane (6000 - 6499 posts)
  
Join Date: Aug 2005
Location: North East, UK
Posts: 6,191 degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level) 
Time spent in forums: 3 Weeks 4 Days 19 h 41 m 52 sec
Reputation Power: 121
Basic Login Validation
Here are some examples of validating a user login to an Access database.


You have a database containing usernames and passwords
Code:
id	username	password
1	User1	        Mypass
2	user2	        12345
3	User3	        abcd
4	Testuser1	pass123
5	Testuser2	abc123




You have a simple form for the user to enter their login details
Code:
<form name="form1" method="post" action="">
  <table width="200" border="1" cellspacing="0" cellpadding="5">
    <tr>
      <td>UserName</td>
      <td><input name="username" type="text" id="username"></td>
    </tr>
    <tr>
      <td>Password</td>
      <td><input name="password" type="password" id="password"></td>
    </tr>
    <tr>
      <td>&nbsp;</td>
      <td><input type="submit" name="Submit" value="Submit"></td>
    </tr>
  </table>
</form>



Here is some basic code to login the user

1) Check if the form has been submitted
2) Connect to the database
3) Query the database and create a recordset
4) Check if the recordset is empty or not
5) Output message to the user

asp Code:
Original - asp Code 
  1. If Len(Request.Form) > 0 Then
  2.  
  3.     ConnDB = Server.MapPath("basic_validation.mdb")
  4.     
  5.     Set Conn = Server.CreateObject("ADODB.Connection")
  6.     Conn.Provider = "Microsoft.Jet.OLEDB.4.0"
  7.     Conn.Open ConnDB
  8.     
  9.     Set rs = Server.CreateObject("ADODB.Recordset")
  10.     rsSQL = "SELECT id, username, password FROM Users" &_
  11.             " WHERE username = '" & Request.Form("username") & "'" &_
  12.             " AND password = '" & Request.Form("password") & "'"
  13.     
  14.     '---------------------
  15.     '## DEBUG ##
  16.     'Response.Write rsSQL
  17.     'Response.End()
  18.     '---------------------
  19.     
  20.     rs.Open rsSQL,Conn
  21.     
  22.     If Not rs.EOF Then
  23.         msg = "Login successful"
  24.     Else
  25.         msg = "Login details not found"
  26.     End If
  27.     
  28.     rs.Close
  29.     Set rs = Nothing
  30.     
  31.     Conn.Close
  32.     Set Conn = Nothing
  33. End If



This will work but it has several problems.
These include the lack of data validation, sanitization of data to prevent SQL Injection attacks and outputting relevant messages to the user.
Comments on this post
lewy agrees: Very nice script and explanation. Excellent job
__________________
CyberTechHelp
Reply With Quote
  #2  
Old May 3rd, 2007, 08:48 AM
degsy degsy is offline
Contributing User
ASP Free God 2nd Plane (6000 - 6499 posts)
  
Join Date: Aug 2005
Location: North East, UK
Posts: 6,191 degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level) 
Time spent in forums: 3 Weeks 4 Days 19 h 41 m 52 sec
Reputation Power: 121
There are somethings that can be done before connecting to or querying the database.

The first is to validate the submitted data

asp Code:
Original - asp Code 
  1. <%@LANGUAGE="VBSCRIPT" CODEPAGE="1252"%>
  2. <%
  3. 'Check if form has been submitted
  4. If Len(Request.Form) > 0 Then
  5.     
  6.     'Request the form fields and assign them to local variables
  7.     username = Request.Form("username")
  8.     password = Request.Form("password")
  9.     
  10.     'Validate the data
  11.     If username = "" Or password = "" Then
  12.         'If there are errors then create an errMsg variable
  13.         errMsg = "Please enter your login details"
  14.     End If
  15.     
  16.     'If everything is ok and their is no errMsg then proceed to the database query
  17.     If errMsg = "" Then
  18.         ConnDB = Server.MapPath("basic_validation.mdb")
  19.         
  20.         Set Conn = Server.CreateObject("ADODB.Connection")
  21.         Conn.Provider = "Microsoft.Jet.OLEDB.4.0"
  22.         Conn.Open ConnDB
  23.         
  24.         Set rs = Server.CreateObject("ADODB.Recordset")
  25.         
  26.         'Create a SQL query to request the user details from the submitted data
  27.         rsSQL = "SELECT id, username, password FROM Users" &_
  28.                 " WHERE username = '" & username & "'" &_
  29.                 " AND password = '" & password & "'"
  30.         
  31.         '---------------------
  32.         '## DEBUG ##
  33.         'Response.Write rsSQL
  34.         'Response.End()
  35.         '---------------------
  36.         
  37.         rs.Open rsSQL,Conn
  38.         
  39.         'Check if the recordset contains a record
  40.         If Not rs.EOF Then
  41.             'If it does then assign local variables for the user details
  42.             id = rs("id")
  43.             username = rs("username")
  44.             password = rs("password")
  45.             
  46.             'Create a msg variable to output to the user
  47.             msg = "Login successful"
  48.         Else
  49.             'If there are errors then create an errMsg variable
  50.             errMsg = "Login details not found"
  51.         End If
  52.         
  53.         rs.Close
  54.         Set rs = Nothing
  55.         
  56.         Conn.Close
  57.         Set Conn = Nothing
  58.     End If
  59. End If
  60. %>
  61. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
  62. <html>
  63. <head>
  64. <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
  65. <title>Basic validation</title>
  66.  
  67. <style type="text/css">
  68. <!--
  69. .msg {
  70.     color: #330099;
  71.     background-color: #66CCFF;
  72.     font-family: Arial, Helvetica, sans-serif;
  73.     font-weight: bold;
  74. }
  75. .error {
  76.     color: #FF0000;
  77.     background-color: #FFFF00;
  78.     font-family: "Courier New", Courier, mono;
  79. }
  80. -->
  81. </style>
  82. </head>
  83.  
  84. <body>
  85. <div>
  86. <% If msg <> "" Then 'Output msg to user%>
  87. <span class="msg"><%=msg%></span>
  88. <p>Welcome <%=username%>, your user ID is <%=id%> and your password is <%=password%></p>
  89. <% ElseIf errMsg <> "" Then 'Output errMsg to user%>
  90. <span class="error">Error: <%=errMsg%></span>
  91. <% End If %>
  92. </div>
  93. <form name="form1" method="post" action="">
  94.   <table width="200" border="1" cellspacing="0" cellpadding="5">
  95.     <tr>
  96.       <td>UserName</td>
  97.       <td><input name="username" type="text" id="username"></td>
  98.     </tr>
  99.     <tr>
  100.       <td>Password</td>
  101.       <td><input name="password" type="password" id="password"></td>
  102.     </tr>
  103.     <tr>
  104.       <td>&nbsp;</td>
  105.       <td><input type="submit" name="Submit" value="Submit"></td>
  106.     </tr>
  107.   </table>
  108. </form>
  109. </body>
  110. </html>



This is the part where the data is requested then validated
asp Code:
Original - asp Code 
  1. username = Request.Form("username")
  2.     password = Request.Form("password")
  3.     
  4.     'Validate the data
  5.     If username = "" Or password = "" Then
  6.         'If there are errors then create an errMsg variable
  7.         errMsg = "Please enter your login details"
  8.     End If


Then we can output a simple message to the user if the user doesn't enter any data
Quote:
Error: Please enter your login details




To expand on this validation you can validate the variables seperately and construct the errMsg variable
asp Code:
Original - asp Code 
  1. If username = "" Then
  2.         errMsg = errMsg & "Please enter your username<br>"
  3.     End If
  4.     
  5.     If password = "" Then
  6.         errMsg = errMsg & "Please enter your password<br>"
  7.     End If

Quote:
Error: There were problems with your submission
Please enter your username
Please enter your password




If the user enters incorrect details then they will receive an error message
asp Code:
Original - asp Code 
  1. If Not rs.EOF Then
  2.             'If it does then assign local variables for the user details
  3.             id = rs("id")
  4.             username = rs("username")
  5.             password = rs("password")
  6.             
  7.             'Create a msg variable to output to the user
  8.             msg = "Login successful"
  9.         Else
  10.             'If there are errors then create an errMsg variable
  11.             errMsg = "Login details not found"
  12.         End If


Quote:
Error: Login details not found




If the user enters correct details then they receive a welcome message
ASP & HTML Code:
Original - ASP & HTML Code 
    
<% If msg <> "" Then 'Output msg to user%>
<span class="msg"><%=msg%></span>
<p>Welcome <%=username%>, your user ID is <%=id%> and your password is <%=password%></p>



So the basic validation to make sure the user submits data is done.

There is more validation to do though.
Reply With Quote
  #3  
Old May 3rd, 2007, 09:16 AM
degsy degsy is offline
Contributing User
ASP Free God 2nd Plane (6000 - 6499 posts)
  
Join Date: Aug 2005
Location: North East, UK
Posts: 6,191 degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level)degsy User rank is First Lieutenant (10000 - 20000 Reputation Level) 
Time spent in forums: 3 Weeks 4 Days 19 h 41 m 52 sec
Reputation Power: 121
Data Sanitization - Prevent SQL Injection Attacks
The data has to also be sanitized to prevent SQL Injection attacks.

At the moment the user submits their data it is fed directly into the SQL query.

asp Code:
Original - asp Code 
  1. rsSQL = "SELECT id, username, password FROM Users" &_
  2.                 " WHERE username = '" & username & "'" &_
  3.                 " AND password = '" & password & "'"



If the user enters
username: user1
password: mypass
then this is the executed query
Quote:
SELECT id, username, password FROM Users WHERE username = 'user1' AND password = 'mypass'


To see the generated SQL query then uncommend the Response.Write rsSQL line
Code:
'---------------------
		'## DEBUG ##
		Response.Write rsSQL
		'Response.End()
		'---------------------




At this point the user could user SQL Injection by using a single quotes/apostrophes in the form fields

If the user enters
username: ' or 1=1 or 'a' = 'a
password: ' or 1=1 or 'a' = 'a
then the executed query would be
Quote:
SELECT id, username, password FROM Users WHERE username = '' or 1=1 or 'a' = 'a' AND password = '' or 1=1 or 'a' = 'a'

This is a valid SQL query and if your output code was a loop to output the recordset then all the records would be output

asp Code:
Original - asp Code 
  1. 'Check if the recordset contains a record
  2.         If Not rs.EOF Then
  3.             While Not rs.EOF 
  4.                 Response.Write rs("id") & "," & rs("username"