PowerASP.com presents.

Advanced Website Password Protection Version 1

Designed By Chris Williams (chris@powerasp.com)

Legal Requirements... If you use this password system.
The link and credit to PowerASP.com must remain within the Administration section.
The credit and link must remain in its original form at the top of the pages and cannot
be altered in any way except for colors. The colors must offer good contrast with the
backgrounds and must be easily visible.

I am trusting you to do this and that is the only stipulation of using this system.

ALSO NOTE: This isn't perfect and could be allot better, but its pretty darn nice for something you are getting for free.  I expect you to download this and (just use it) or (improve on it) or (learn from it). If you do one of those 3 things then I am happy. There a quite a few things I took shortcuts on to get this finished quicker, but then again I don't really want to give out perfect software. What fun would that be, you wouldn't learn anything and I'd be out of a job.

DIRECTIONS (It is recommended that you read all of this carefully)

They are currently very messy. When I get a chance I will clean them up.


Copy the contents of this zip into the root of your website

The zip contains the following files and folders
FOLDER _database The database directory and sample database
FOLDER password_admin The Administration portion of this   
FILE check_user_inc.asp The password protection script
FILE simple_example.asp Example of how to include the password script and NOT check for access levels
FOLDER multiple_access_levels Example of how to include the password script and manage access levels if you want to do that.
Here are some things you need to do to get this working.

Manually specify the data path in check_user_inc.asp
This has to be set manually. You cannot use Server.MapPath because
this file will be included in every page you password protect.

EX:)
DATA_PATH = "C:\Inetpub\wwwroot\password\_database\passwords.mdb"

If you change the password for the access database set that also. See Access help files for information on changing a database password.

EX:)
ConnPasswords_RuntimePassword = "Xpass"
If running NT make sure the Database or Database Directory has
Change permissions for the anonymous account.
Here is some additional info you might like to know.

By default there are 3 sample users each with different access.

ADMINS can add and remove other ADMINS...   You could easily modify the way all that works, but that is how I made this for now.

This is an Admin account. (Admins do not use the Access_Level Field and have access to everything.)
username test
password test

This user has Basic access. (Basically this user has basic access only.)
username joe
password test

This user has Full access.  (Basically this user has basic access and full access.)
username tom
password test

Use the Admin account to get into the Admin Area and manage users.
If you lose Admin access because you unchecked it or forgot the password
you will have to open the database up via Microsoft Access and add
Admin access to an existing user in order to gain access to the Web Admin again.
To take advantage of the multiple access levels you will need to
add additional script within your pages.
This is fairly easy but requires some careful coding.
Most users of this will not even use this feature.

This is currently implemented by typing the access level in manually and it has to be perfect (Its case sensitive) so it matches the access levels specified in the include file. Yes you can improve on this system because I didn't make it perfy and yes there didn't really need to be a checkbox for admin access as I could have integrated that into the access level field instead of making it separate, but like I said before this isn't perfect and I expect those who want more out of it to improve on it.

Please examine the code in the multiple-access-levels example to see how this is done.
Sorry... I do not have a tutorial available for this.
After a user logs in there are variables that you can always access.
They can be used to check various things or to display information
dynamically based on who has logged into the system.

Session("PASSWORDACCESS")
Session("ACCESS_LEVEL")
Session("FULL_NAME")
Session("PASSWORD")
Session("USERNAME")
Session("ADMIN")

You can display them on a page using Response.Write like so

<% Response.Write(Session("FULL_NAME")) %>

or like this

<% = Session("FULL_NAME") %>


Disclaimer... PowerASP and Chris Williams make no guarantee about the security this script offers. Use this at your own risk. To the best of knowledge it is very secure, but that doesn't mean there isn't a bug or some hacker will never find a way into it. We recommend you rigorously test it and change the password on the Access database before you start using this. That way if someone downloads your database they will a hard time getting anything useful out of it especially since the database supplied with this download is also encrypted. If you really want secure password protection you should port this to a SQL database.