Member Avatar for sonia sardana

I want to develop a login page ,i want that admin username & password to be saved in asp file suppose FrmLoginDetails.asp. Username - sonia
Password - citm123
When the user logins,i want that his entered usernme & password to be compared with the that are stored in file FrmLoginDetails.asp..

Can somebody tell me how to store the details in file & retrive from that file!

  • 3 Contributors
  • 2 Replies
  • 103 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by sedgey

Dani AI

Generated

asked how to keep admin credentials in an ASP file. That idea is unsafe in production and both and were right to suggest alternatives. Storing plaintext credentials inside a web-served file risks accidental exposure (misconfiguration, backups, or backup copies), and classic ASP has no built‑in, modern password hashing. The recommended pattern is: keep credentials outside the web root, restrict filesystem permissions to the IIS user, and — preferably — store accounts in a database and save only salted, one‑way hashes (see the OWASP Password Storage guidance).

For constrained learning scenarios where a simple file is required, use a plain text file outside the web root and have server code read it. Example file format (one account per line): admin:secretpass. Minimal classic-ASP reader (plaintext comparison — insecure, for demonstration only):

<%
Dim fso, f, line, parts, storedUser, storedPass
Dim inputUser, inputPass, found

inputUser = Request.Form("username")
inputPass = Request.Form("password")

Set fso = Server.CreateObject("Scripting.FileSystemObject")
Set f = fso.OpenTextFile("C:\secure\FrmLoginDetails.txt", 1) ' outside web root, readable only by IIS account

found = False
Do While Not f.AtEndOfStream
    line = Trim(f.ReadLine)
    If line <> "" Then
        parts = Split(line, ":")
        storedUser = parts(0)
        storedPass = parts(1)
        If LCase(storedUser) = LCase(inputUser) And storedPass = inputPass Then
            found = True
            Exit Do
        End If
    End If
Loop
f.Close
Set f = Nothing
Set fso = Nothing

If found Then
    ' authenticated
Else
    ' reject
End If
%>

Key hardening points left out of many simple examples: never store plaintext in a production system; use TLS; move credentials to a database and store salted hashes per OWASP; protect files with NTFS permissions; log and throttle failed attempts; and consider moving to a framework with built‑in auth (ASP.NET forms auth or modern frameworks). For reading files from classic ASP see the FileSystemObject notes: . For secure password storage practices see OWASP: Password Storage Cheat Sheet.

Recommended Answers

All 2 Replies

Member Avatar for sknake

You shouldn't be using .asp pages to store login credentials, and you probably shouldn't be opening the page source for your project at runtime in a web environment.

Why not just use a database? You could also hard-code in the user information in to the program (another bad approach).

Member Avatar for sedgey

I agree with sknake safest place is in the database, if you don't have one why not use ASP.NET forms authentication and put the login details in the web.config file?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.