how to control the right of html accessing

[Kris Eiben]

Use asp or jsp for ALL pages you want to protect, so you can include
server-side code. Then, at the top of every restricted page, check to
make sure the user has access to the page -- and if not, redirect to a
"sorry, you need to log in" page. That way, if the user's not logged
in, he will never see the content of the page even if he has bookmarked
the URL.

An example using session variables, assuming all users with rights can
see all pages:
1) Store the user's ID in a session variable when he first logs in
Session("userID") = whatever
2) On the top of each page:
' set up connection
SQL = "Select userID from user_rights where userID = " &
Session("userID")
set rs = conn.Execute(SQL)
if rs.EOF then
' clean up recordset and connection
response.redirect "YouNeedToLogin.asp"
end if
'rest of page goes here

You could improve this login procedure by sending a querystring variable
to the YouNeedToLogin page, so that when the user logs in you can return
him to the page he was trying to access.

"jack" <fei_ying@21cn.com> wrote in message
news:08cc01c34503$d7435b40$a301280a@phx.gbl...

> i have a task as following:
> some body has right to access an html page,some body has
> no right,these right information
>
> are in database...sounds simple,get information from
> database,verify if the user has that
>
> right,then go to that page or not go to.......but if i
> programme on server using asp or
>
> jsp,at the end ,i need to use the url where is the place
> of that html,so user ALWAYS can
>
> input that url directly into the browser to access that
> html,that 's the question....anybody
>
> can help me????

[jack]

>-----Original Message-----
>Use asp or jsp for ALL pages you want to protect, so you

can include

>server-side code. Then, at the top of every restricted

page, check to

>make sure the user has access to the page -- and if not,

redirect to a

>"sorry, you need to log in" page. That way, if the

user's not logged

>in, he will never see the content of the page even if he

has bookmarked

>the URL.
>
>An example using session variables, assuming all users

with rights can

>see all pages:
>1) Store the user's ID in a session variable when he

first logs in

> Session("userID") = whatever
>2) On the top of each page:
> ' set up connection
> SQL = "Select userID from user_rights where

userID = " &

>Session("userID")
> set rs = conn.Execute(SQL)
> if rs.EOF then
> ' clean up recordset and connection
> response.redirect "YouNeedToLogin.asp"
> end if
> 'rest of page goes here
>
>You could improve this login procedure by sending a

querystring variable

>to the YouNeedToLogin page, so that when the user logs in

you can return

>him to the page he was trying to access.
>
>"jack" <fei_ying@21cn.com> wrote in message
>news:08cc01c34503$d7435b40$a301280a@phx.gbl...

>> i have a task as following:
>> some body has right to access an html page,some body has
>> no right,these right information
>>
>> are in database...sounds simple,get information from
>> database,verify if the user has that
>>
>> right,then go to that page or not go to.......but if i
>> programme on server using asp or
>>
>> jsp,at the end ,i need to use the url where is the place
>> of that html,so user ALWAYS can
>>
>> input that url directly into the browser to access that
>> html,that 's the question....anybody
>>
>> can help me????

>
>
>.
>

[jack]

thank you ,very much

>-----Original Message-----
>Use asp or jsp for ALL pages you want to protect, so you

can include

>server-side code. Then, at the top of every restricted

page, check to

>make sure the user has access to the page -- and if not,

redirect to a

>"sorry, you need to log in" page. That way, if the

user's not logged

>in, he will never see the content of the page even if he

has bookmarked

>the URL.
>
>An example using session variables, assuming all users

with rights can

>see all pages:
>1) Store the user's ID in a session variable when he

first logs in

> Session("userID") = whatever
>2) On the top of each page:
> ' set up connection
> SQL = "Select userID from user_rights where

userID = " &

>Session("userID")
> set rs = conn.Execute(SQL)
> if rs.EOF then
> ' clean up recordset and connection
> response.redirect "YouNeedToLogin.asp"
> end if
> 'rest of page goes here
>
>You could improve this login procedure by sending a

querystring variable

>to the YouNeedToLogin page, so that when the user logs in

you can return

>him to the page he was trying to access.
>
>"jack" <fei_ying@21cn.com> wrote in message
>news:08cc01c34503$d7435b40$a301280a@phx.gbl...

>> i have a task as following:
>> some body has right to access an html page,some body has
>> no right,these right information
>>
>> are in database...sounds simple,get information from
>> database,verify if the user has that
>>
>> right,then go to that page or not go to.......but if i
>> programme on server using asp or
>>
>> jsp,at the end ,i need to use the url where is the place
>> of that html,so user ALWAYS can
>>
>> input that url directly into the browser to access that
>> html,that 's the question....anybody
>>
>> can help me????

>
>
>.
>