Let's say you have a form called login.asp which has a section that looks like this:
' -------------------------
' -------------------------
So the user clicks the Submit button and the form data gets passed to another page called password.asp. In that page, you'll have code that does something like this:
' -------------------------
Dim userid
Dim password
Dim rsTable
Dim strSQL
' Get the variable values from the previous form
userid = request.form("uid")
password = request.form("pwd")
Session("uid") = userid ' save the user id in a session variable
' Open database connection
Set adoCon = Server.CreateObject("ADODB.Connection")
adoCon.Open "DSN=MyDatabase.dsn"
' Open the table find a record with the user name
strSql = "select password, FirstName, LastName, " & _
"email, [group], upload " & _
"from tblUsers " & _
"where userid='" & userid & "';"
Set rsTable = Server.CreateObject("ADODB.Recordset")
rsTable.open strSQL,adoCon ' Note: adoCon is a database
' If the user id was not found, redirect to invalid.asp page
If rsTable.EOF or rsTable.BOF Then
Response.Redirect "invalid.asp?e=u"
End If
' UserID Record found. Does password match?
If rsTable("password") <> password Then
Response.Redirect "invalid.asp?e=p"
End If
' Save any other user info that you need as session variables:
Session("FName") = rsTable("FirstName")
Session("LName") = rsTable("LastName")
Session("email") = rsTable("email")
rsTable.Close
' Redirect back to home page
Response.Redirect "index.asp"
' -------------------------