Session variables in DWMX

**VegaLA** · 03-07-2005, 08:02 PM

Hello all,
I need some advice with Session Variables. I have ben reading through the authentication section in the 'The Missing Manual' book for Dreamweaver MX and it has been very helpfull. Using the session variable mm_Username I have got the asp page to display the username of the user that has logged in, however I would now like to use that to allow the user to edit records they have created themselves. For example I have created a asp page that allows them to book rooms in the office. They are booked by name, room and time start and time finnish. The asp page that list all the rooms booked from today onwards has also allows the users to edit the times by clicking the edit text next to each record, however anyone who logs in can edit someone else's booking. I would like it to only allow the person who booked the room/created the record to be able to edit that particular record. I read through the chapter in the book and typed in this code...

<% IF Session("MM_Username") = "UserN" THEN %><a href="editbook.asp?id=<%=(rstBookList.Fields.Item( "IDbk").Value)%>">Edit</a><% END IF %>

...however having tested it myself it does not work, all the edit links have disapeared from the view and the one I created using my username is also not displayed, the one record that should actually show. I realize that the code above should not say "usern" but the variable that is used for username, however i do not know how to code this.
Can anyone offer some advice please ?

Mitch....

**Minaki** · 03-08-2005, 05:05 AM

Put in code to display the values to make sure they are what you are expecting:
<%= Session("MM_Username") %> <%= "UserN" (or whatever) %>

A word of advice, depending on how secure you want this to be, it would be wise to put some code into editbook.asp to check the username, preventing people from simply typing the URL into their browser.

**VegaLA** · 03-08-2005, 02:08 PM

Thanks for the advice Minaki.
I have tested the page by adding the session variable and the correct field from the recordsource to ensure it is comparing against the right field and so far so good. I had to create a variable for the Username field (not UserN - which is the more detailed name that is displayed on the page) and added the Username field to the list just to make sure it is looking at the right one. I then added this code...

Dim UsrNm

UsrNm = rstBookList.Fields.Item("UserName").Value

.....in some code that exists further up the page...

<%
Dim Repeat1__numRows
Dim Repeat1__index
Dim UsrNm

Repeat1__numRows = -1
Repeat1__index = 0
rstBookList_numRows = rstBookList_numRows + Repeat1__numRows
UsrNm = rstBookList.Fields.Item("UserName").Value
%>

..and further down where the list is generated I added the code you suggested...

<td> </td>
<td><%=(rstBookList.Fields.Item("Room").Value)%> </td>
<td><%=(rstBookList.Fields.Item("UserN").Value)% ></td>
<td> </td>
<td><%= DoDateTime((rstBookList.Fields.Item("DateD").Value ), 2, 1033) %></td>
<td><%=(rstBookList.Fields.Item("UserName").Value) %></td>
<td><%=(rstBookList.Fields.Item("TimeS").Value)% ></td>
<td><%=(rstBookList.Fields.Item("TimeF").Value)% ></td>
<td><% (Session("MM_Username")) = ("UsrNm") THEN %><a href="editbook.asp?id=<%=(rstBookList.Fields.Item( "IDbk").Value)%>">Edit</a><% END IF %></td>

Now at first since I have never created a variable using a field from a recordset I thought the whole thing would throw up but no, it did display the list, however the Edit link has disapeared again and not showing on the one entry that has the same value as the MM_Username session variable.
I feel I am getting closer but not close enough... any advice ?

Mitch.....

**Minaki** · 03-08-2005, 04:27 PM

Quote:

<% (Session("MM_Username")) = ("UsrNm") THEN %><a href="editbook.asp?id=<%=(rstBookList.Fields.Item( "IDbk").Value)%>">Edit</a><% END IF %>

Doesn't that throw an error? There's no IF statement...

Take out the lines:
Dim UserNm
UsrNm = rstBookList.Fields.Item("UserName").Value
They're not needed.

Then modify it to look like this:

Code:

<% If Session("MM_Username") = rstBookList.Fields.Item("UserName").Value THEN %>
<a href="editbook.asp?id=<%=(rstBookList.Fields.Item("IDbk").Value)%>">Edit</a>
<% End If %>

Then with any luck it should work

The way you were doing it, by setting UserNm at the top, the value of UserNm would only ever hold the value of the first record returned. You would of needed to put it inside the loop and set it each time for that to work. However the way I've shown you eliminates the need for a variable - we just compare the values directly at the time.
Secondly, ("UsrNm") is not a variable - it's a litral cos it's in quotes. The correct way should be
If Session("MM_Username") = UsrNm Then
However, as I stated before, I eliminated the need for a variable.

**VegaLA** · 03-08-2005, 07:02 PM

Excellent, thank you so much Minaki, that worked perfectly !!

**VegaLA** · 03-14-2005, 09:14 PM

Hello again,
didn't think i'd be back so soon but here I am.
I have been asked to allow the receptionist control of editing everyones booking entrys so I tried changing the code you gave me to loo like this...

<% If Session("MM_Username") = rstBookList.Fields.Item("UserName").Value OR If Session("MM_Username") = ("csmith") THEN %><a href="editbook.asp?id=<%=(rstBookList.Fields.Item( "IDbk").Value)%>">Edit</a>
<% End If %

It displayed an error saying incorrect syntax for that line so i'm obviously coding it wrong. I did try chaning ("csmith") to (csmith), 'csmith', csmith, and "csmith" but no avail. Can anyone point out where i'm going wrong please ?

Mitch.........

**Minaki** · 03-15-2005, 06:02 AM

Sure

Just take out the 2nd IF Statement, and you don't need the brackets around "csmith".

Code:

<% If Session("MM_Username") = rstBookList.Fields.Item("UserName").Value OR Session("MM_Username") = "csmith" THEN %>
<a href="editbook.asp?id=<%=(rstBookList.Fields.Item("IDbk").Value)%>">Edit</a> 
<% End If %>

From my Delphi days, I usually put brackets around each comparison:

Code:

<% If (Session("MM_Username") = rstBookList.Fields.Item("UserName").Value) OR (Session("MM_Username") = "csmith") THEN %>
<a href="editbook.asp?id=<%=(rstBookList.Fields.Item("IDbk").Value)%>">Edit</a> 
<% End If %>

In Delphi, the reason for this was to force those expressions to be evaluated first cos otherwise Delphi would compare the OR operator first, i.e.
rstBookList.Fields.Item("UserName").Value OR Session("MM_Username")
Which doesn't really work.

It's not needed in VB. I do it out of habbit and for readability.

**VegaLA** · 03-15-2005, 12:42 PM

Oh I see. I thought IF was mentioned twice in a statement like that in VB. I really need to drop the DWMX and start to learn to code in VBScript. The ironic thing is a few years ago I used to develop in Access 97 so I should have remembered. Some of these development software packages can make you lazy............

Thanks again for your help though, worked a treat,
Mitch..........