Scott wrote:
> I have this web page, right now they have to enter a password to move on to
> the next page.
> My problem is that the actual password is in the "view source" code.
> How can I get the page to read the password without showing the password at
> the same time?
> -
> -
> Here is my code:
> -
> <html>
>
> <head>
>
> </head>
>
> <body background=Image3.gif>
>
> <H2>To access the OrderForm - Please enter your password</H2>
>
> <br>
>
> <b>System Password:</b>
>
> <input type=password name=zzzWord size=33>
>
> <input type=button value="Enter" onclick="Eva()">
>
> <script language="JavaScript">
> function Eva()
> {
> if (zzzWord.value !=""&& zzzWord.value !=null)
> {
> if (zzzWord.value=="THISISTHEPASSWORD")
>
> {
> document.location.href='cart1.html'
> }
> else
> {
> alert('Access Denied')
> }
> }
> }
>
> </script>
>
> <br>
>
> <H3>Orders Must Be Submitted By Property Managers or Property
> Administrators</H3>
>
> </body>
>
> </html>
>
>
You cannot do this in the client (Web Browser). You need to write
server-side code to handle the login.
Here's an example that works in ASP:
HTML
<html>
<head>
</head>
<body>
<form method="post" action="checklogin.asp">
<label> Enter password to continue: <input type="password"
name="passwordfield" value="" /> </label>
</form>
</body>
</html>
ASP file called checklogin.asp:
<html>
<head>
</head>
<body>
<%
session("validuser") = false
if request("passwordfield") = "this_is_the_password" then
session("validuser") = true
response.redirect("url_of_page_here.asp")
else
response.write("bad password used, not gonna let you in")
end if
%>
</body>
</html>
By setting a session, you can check on any pages you create to see if
the user has entered the right password. This means you can now secure
lots of pages by adding...
<% if session("validuser") <> true then
response.redirect("intruderalertpage.asp")
%>
.... to the top of any page.
Okay so this example was ASP only, and I expect you won't get it right
away, but it demonstrates, I hope, that you really cant just hack
together some security that runs inside the browser and hope it works.
If it is in the browser, inside JavaScript, it can be hacked or bypassed
in seconds whatever you do - in other words totally pointless. You MUST
do password checking at scripts running on the server - these scripts
can never be seen by the user, and are vastly more secure. Scripts that
run on a server are invisible to a web browser - they only get the
resulting HTML output (so everything between <% and %> is only run by
the server).
--
x theSpaceGirl (miranda)
http://www.northleithmill.com
-.-
Kammy has a new home:
http://www.bitesizedjapan.com >> Stay informed about: password to access next page 
FAQ
Search
Profile
Private Messages
Log in
