Problem passwords not going to the right place

[WebGodiva]

I have set up on my intranet a form where the user logs in using a user name and password stored in my access database.&nbsp;&nbsp;Managers in the same database have an office code they must input (this part works well).&nbsp;&nbsp;The problem I'm having is that when you type anything into the form fields of username and password without the office code set-up for the Managers it will allow anyone to enter the site.<br><br>I thought it was supposed to verify against the database.&nbsp;&nbsp;The code for the form looks like below:<br><br>&lt;form action=&quot;index.cfm&quot; method=&quot;POST&quot;&gt;<br>&lt;table width=&quot;70%&quot; align=&quot;center&quot;&gt;<br>&lt;tr&gt;<br>&lt;td width=&quot;70%&quot; align=&quot;left&quot; valign=&quot;top&quot; style=&quot;padding-left: 15px;&quot;&gt;<br>&lt;font size=&quot;-1&quot;&gt;&lt;b&gt;Please Type in Your User Name:&lt;/b&gt;&lt;/font&gt;<br>&lt;input type=&quot;text&quot; name=&quot;UserID&quot; id=&quot;UserID&quot; size=&quot;35&quot; maxlength=&quot;50&quot; tabindex=&quot;1&quot;&gt;&lt;br&gt;&lt;br&gt;<br>&lt;font size=&quot;-1&quot;&gt;&lt;b&gt;Please Type in Your Password:&lt;/b&gt;&lt;/font&gt;<br>&lt;input type=&quot;password&quot; name=&quot;Password&quot;&nbsp;&nbsp;size=&quot;15&quot; maxlength=&quot;25&quot; tabindex=&quot;2&quot;&gt;&lt;br&gt;&lt;br&gt;<br>&lt;font size=&quot;-1&quot;&gt;&lt;b&gt;If you are a manager, Please enter your office code here:&lt;/b&gt;&lt;/font&gt;&lt;input type=&quot;text&quot; name=&quot;OfficeCode&quot; size=&quot;6&quot; maxlength=&quot;10&quot; tabindex=&quot;2&quot;&gt;&lt;br&gt;&lt;br&gt;<br>&lt;input type=&quot;submit&quot; name=&quot;Submit&quot; id=&quot;Submit&quot; value=&quot;Enter our Secured Site&quot;&gt;<br>&lt;/form&gt;<br>&lt;/td&gt;<br>&lt;/tr&gt;<br>&lt;/table&gt;<br><br>the code on the page that it is supposed to pass the data to (index.cfm) looks like below:<br><br>&lt;!DOCTYPE HTML PUBLIC &quot;-//W3C//DTD HTML 4.0 Transitional//EN&quot;&gt;<br>&lt;cfquery name=&quot;CheckRequired&quot; datasource=&quot;user&quot; dbtype=&quot;ODBC&quot;&gt;<br>SELECT * <br>FROM Users<br>WHERE User='#form.UserID#' <br>AND Pass='#form.Password#'<br>AND Officecode='#Officecode#'<br>&nbsp;&lt;/cfquery&gt;<br>&lt;html&gt;<br>&lt;head&gt;<br><br> &lt;title&gt;Local Intranet&lt;/title&gt;<br>&lt;/head&gt;<br><br>&lt;body style=&quot;FONT-FAMILY: Arial, Helvetica, sans-serif; FONT-SIZE: small; FONT-VARIANT: small-caps&quot; background=&quot;Background.gif&quot;&gt;<br>&lt;cfif CheckRequired.RecordCount&gt;<br>&lt;cfset session.authenticated=1&gt;<br>&lt;cflocation url=&quot;manager.cfm&quot; addtoken=&quot;yes&quot;&gt;<br>&nbsp;&lt;cfelse&gt;<br>you are not authenticated please use your back button to go back and reenter your username and password.<br>&lt;/cfif&gt;<br><br>Why wont it verify against the database which is identify in the datasource from the query?<br><br>Any help you could give would be appreciated - I'm new at all of this and am supposed to have the site up and running next week.<br>

 

[DarkMan]

It looks like anyone who is authenticated whether or not there is an office code goes to the manager.cfm page...<br><br>Try:<br><FONT FACE=monospace><b><br>&lt;cfif CheckRequired.RecordCount&gt;<br>&nbsp;&nbsp;&lt;cfset session.authenticated=1&gt;<br>&nbsp;&nbsp;&lt;cfif len(CheckRequired.Officecode)&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfset session.manager=1&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;cflocation url=&quot;manager.cfm&quot; addtoken=&quot;yes&quot;&gt;<br>&nbsp;&nbsp;&lt;cfelse&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfset session.manager=0&gt;&nbsp;&nbsp;<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;cflocation url=&quot;non-manager.cfm&quot; addtoken=&quot;yes&quot;&gt;<br>&nbsp;&nbsp;&lt;/cfif&gt;<br>&lt;cfelse&gt;<br>&nbsp;&nbsp;you are not authenticated please use your back button to go back and reenter your username and password.<br>&lt;/cfif&gt;<br></b></font><br>You can use the session.manager variable to verify that someone is logged in as a manager or not and act accordingly...<br><br>Hope this helps...<br><br>DM