ASPSample

This simple project illustrates the potential for the ASPHelp system to document a web. This sample contains multiple paths of execution that would not be visible to a simple spider tool, but which are valuable to QA professionals, and information architects.

©Pikauba Software, 2001 - 2004. All rights reserved.

Help compiled by ASPHelp, a Pikauba Software product. All rights reserved.


ASPSample - PagesTitle

Pages ASPSample

ASPSample - Pages

These are the pages forming this project.

Categories

All
Form input
Collects data
Query string input


ASPSample - AllTitle

All ASPSample

ASPSample - All

These are the web pages forming this project.

Pages

default.asp
login.asp
logonConfirmation.asp
logonFailure.asp
SystemError.asp


default.asp

Source

The default page for the system

Access method: Query String

Calling web pages

URL | Description
logonFailure.asp | Notify the user that their logon has failed.
SystemError.asp | Displayed when another page has encountered an error indiciative of a possible system error. Allows the user to continue processing.

Cookie keys

Key | Description
Session | Cookie contains the session ID

Query string variables

Variable | Description
SessionExpired | Indicates an expired session

Session variables

Variable | Description
Connection | The database connection to use for this session
UserName | The logged in user's name. Used for greetings.

Application variables

Variable | Description
ConnectionCache | Obtain a valid connection from the connection cache the server is maintaining.

Image Maps

Map name: LoginArea

An image map inviting users to register or login. It contains both secure and non-secure versions.

newnonsecure

Image for new user registration - non SSL version
Element name: newnonsecure
Action location: Value is from script block: pageURL("login.asp?new=yes")

oldsecure

Image for returning user login - SSL version
Element name: oldsecure
Action location: login.asp

newsecure

Image for new user registration - SSL version
Element name: newsecure
Action location: login.asp

Variable Description
new Value is "yes".
Indicates that the user is a new user

oldnonsecure

Image for returning user login - non SSL version
Element name: oldnonsecure
Action location: Value is from script block: pageURL("login.asp")

HTML forms

login

The login form collects all the information and posts to login.asp. Validation occurs there.
Access method: POST
Element name: login
Action location: /login.asp

Variable | Type | Description
cookieCheck HIDDEN Default value: 1
Indicates if cookies are enabled
UserId | TEXT | The user id the user enterd to login
Validate | HIDDEN | Default value: 1
UserPassword | PASSWORD | The password the user supplied. Note that this value is not encrypted.
submit SUBMIT Default value: Login
Indicates submission occured
clear RESET Default value: Clear Entry
Clears the form contents, not submitted to the system.

Applies to

Pages__All - | Pages__Collects data - | Pages__Query string input - | Session variables - Connection | Session variables - UserName | Cookies - Session | Application variables - ConnectionCache


login.asp

Source

Attempt to login a user. Login.asp performs all the required validation. If the required login parameters are missing, the user is sent to the login failure page. If the input form is missing information, a system error is generated.

Access method: Form

Files directly included:

File path | Type
bad.inc | File include

Calling web pages

URL | Description
default.asp | The default page for the system

Input form variables

Element | Description
Validate | A semaphore flag used to ensure that the post is valid
UserId | The user name as entered
UserPassword | The password the user entered. This is not encrypted at this point, beyond what SSL would achieve.

Object usage:

Server object: Login

Object scope: Page
Class name: Login

Methods in file:

baseURL
Procedure type: Function
Execution context: Server
Parameter name | Passed | Description
s | ByVal
Login
Procedure type: Public Function
Execution context: Server
Parameter name | Passed | Description
sUID | ByVal
sPWD | ByVal
middle
Procedure type: Function
Execution context: Client
normal
Procedure type: Function
Execution context: Server
SimpleTest
Procedure type: Subroutine
Execution context: Client
Validate
Procedure type: Public Function
Execution context: Server
Parameter name | Passed | Description
sUID | ByVal
sPWD | ByVal

Applies to

Pages__All - | Pages__Form input -


logonConfirmation.asp

Source

Notify the user that they're logged on

Access method: No information passed to this page.

Session variables

Variable | Description
LoginName | The user's login name
HomePage | The user's personalized home page is stored here

Frames

PreviousActions

This frame provides the user with a history of their past actions.
Element name: PreviousActions
Action location: history.asp

Variable Description
user Default value is from the ASP element: "objSession("LoginName")".
The user for whom we are attempting to obtain the history

HTML forms

Continue

When the user clicks on the confirmation button, they are magically transported to their customized home page.
Access method: POST
Element name: Continue
Action location: Value is from script block: objSession("HomePage")

Variable Type Description
BtnContinue SUBMIT Default value: Continue
The magic button

Applies to

Pages__All - | Pages__Collects data - | Session variables - LoginName | Session variables - HomePage


logonFailure.asp

Source

Notify the user that their logon has failed.

Access method: Query String

Cookie keys

Key | Description
Session | The session cookie we are using.
Expired | Have a cookie key to let us know what happened to the session.

Query string variables

Variable | Description
NoCheck | Indicates if we should check and logout the user.

Anchors

Link text: Home

The user gets to go back to the default page to login again.
Documentation key: Home
Action location: /default.asp

Applies to

Pages__All - | Pages__Query string input - | Cookies - Session | Cookies - Expired


SystemError.asp

Source

Displayed when another page has encountered an error indiciative of a possible system error. Allows the user to continue processing.

Access method: No information passed to this page.

Anchors

Link text: Home

The link to the user's home page
Documentation key: Home
Action location: default.asp

Variable Description
pageid Value is "1".
The root home page.

Applies to

Pages__All -


ASPSample - Collects dataTitle

Collects data ASPSample

ASPSample - Collects data

These web pages collect data from the user, and submit the data to the server.

Pages

default.asp
logonConfirmation.asp


ASPSample - Form inputTitle

Form input ASPSample

ASPSample - Form input

These web pages receive input from a form POST.

Pages

login.asp


ASPSample - Query string inputTitle

Query string input ASPSample

ASPSample - Query string input

These web pages receive input from either a querystring or form GET method.

Pages

default.asp
logonFailure.asp


ASPSample - IncludesTitle

Includes ASPSample

ASPSample - Includes

The following files are included in the project.

Includes

bad.inc


bad.inc

Source

Included in the following pages:

URL | Description
login.asp | Attempt to login a user. Login.asp performs all the required validation. If the required login parameters are missing, the user is sent to the login failure page. If the input form is missing information, a system error is generated.


ASPSample - Application variablesTitle

Application variables ASPSample

ASPSample - Application variables

The following application variables are used in this project.

Variables

ConnectionCache

Variables

ConnectionCache


ASPSample - ConnectionCacheTitle

ConnectionCache ASPSample

ASPSample - ConnectionCache

The following pages make use of the ConnectionCache application variable.

Pages

default.asp


ASPSample - CookiesTitle

Cookies ASPSample

ASPSample - Cookies

The following cookies are used in this project.

Cookies

Session
Expired

Pages

Expired
Session


ASPSample - ExpiredTitle

Expired ASPSample

ASPSample - Expired

The following pages make use of the Expired cookie.

Pages

logonFailure.asp


ASPSample - SessionTitle

Session ASPSample

ASPSample - Session

The following pages make use of the Session cookie.

Pages

default.asp
logonFailure.asp


ASPSample - Session variablesTitle

Session variables ASPSample

ASPSample - Session variables

The following session variables are used in this project.

Variables

Connection
UserName
LoginName
HomePage

Pages

Connection
HomePage
LoginName
UserName


ASPSample - ConnectionTitle

Connection ASPSample

ASPSample - Connection

The following pages make use of the Connection session variable.

Pages

default.asp


ASPSample - HomePageTitle

HomePage ASPSample

ASPSample - HomePage

The following pages make use of the HomePage session variable.

Pages

logonConfirmation.asp


ASPSample - LoginNameTitle

LoginName ASPSample

ASPSample - LoginName

The following pages make use of the LoginName session variable.

Pages

logonConfirmation.asp


ASPSample - UserNameTitle

UserName ASPSample

ASPSample - UserName

The following pages make use of the UserName session variable.

Pages

default.asp


bad.inc - Source Code

Summary listing

<%

' just a simple include for testing -- nothing more

%>


default.asp - Source Code

Summary listing

<%@LANGUAGE=VBscript enablesessionstate=false LCID=1033%>
<%
'##BD The default page for the system
'##SV_BEGIN UserName ^^ The logged in user's name. Used for greetings. ##SV_END
'##SV_BEGIN User Name ^^ The logged in user's name. Used for greetings. ##SV_ENd
'##RQ SessionExpired ^^ Indicates an expired session
'##RC Session ^^ Cookie contains the session ID
'##FR Login ^^ The login form collects all the information and posts to login.asp. Validation occurs there.
'##FV_BEGIN Login ^^ cookieCheck ^^ Indicates if cookies are enabled ##FV_END
'##FV Login ^^ UserId ^^ The user id the user enterd to login
'##FV Login ^^ UserPassword ^^ The password the user supplied. Note that this value is not encrypted.
'##FV Login ^^ submit ^^ Indicates submission occured
'##FV Login ^^ clear ^^ Clears the form contents, not submitted to the system.
'##SV Connection ^^ The database connection to use for this session
'##AV ConnectionCache ^^ Obtain a valid connection from the connection cache the server is maintaining.
'##IM LoginArea ^^ An image map inviting users to register or login.
'##IM LoginArea ^^It contains both secure and non-secure versions.
'##IMA LoginArea ^^newnonsecure ^^ Image for new user registration - non SSL version
'##IMA LoginArea ^^newsecure ^^ Image for new user registration - SSL version
'##IMA LoginArea ^^oldnonsecure ^^ Image for returning user login - non SSL version
'##IMA LoginArea ^^oldsecure ^^ Image for returning user login - SSL version
'##QIM LoginArea ^^newnonsecure ^^ new ^^ Indicates that the user is a new user
'##QIM LoginArea ^^newsecure ^^ new ^^ Indicates that the user is a new user

Option Explicit
Response.Buffer = false

Dim strPageTitle
strPageTitle = "Home Page"

objSession("Connection") = Application("ConnectionCache")
If Request.QueryString ("SessionExpired").count <> 0 Then
Response.Write objSession("UserName") & ", your session has expired"
End If

' do the cookie stuff
Response.Cookies("Session") = CStr(objSession.SessionID)
%>
<html>
<head>
<title><%=strPageTitle%></title>
</head>
<body bgcolor="#FFFFFF" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0" text="#000000">
<map name="LoginArea">
<area shape="rect" name=newnonsecure coords="0,0,96,12" href="<%=pageURL("login.asp?new=yes") %>">
<area shape="rect" name=oldsecure coords="108,0,149,12" href="<%=pageSURL("login.asp") %>">
<area shape="rect" name=newsecure coords="161,0,244,12" href="<%=pageSURL("login.asp?new=yes") %>">
<area shape="rect" name=oldnonsecure coords="258,0,294,12" href="<%=pageURL("login.asp") %>">
</map>

<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr><td valign="top"></td></tr>
<td valign="top">
<table width="446" border="0" cellspacing="0" cellpadding="5">
<tr>
<td width="446">
<blockquote>
<font face="Arial, Helvetica, sans-serif" size="4" color="#003366"><b><%=strPageTitle%></b></font>
<p><font face="Arial, Helvetica, sans-serif" size="2">Welcome to the ASHelp test page.</font></p>
<form method="post" action="<%=baseSURL("/login.asp") %>" name="login">
<input type="hidden" name="cookieCheck" value="1">
<table width="355" border="0" cellspacing="0" cellpadding="1" bgcolor="#99CC99" hspace="10">
<tr>
<td colspan="2">
<table width="355" border="0" cellspacing="0" cellpadding="5" align="center" bgcolor="#99CC99">
<tr valign="middle" bgcolor="#99CC99">
<td colspan="2">
<font face="Arial, Helvetica, sans-serif" size="2"><b>Login</b></font>
</td>
</tr>
<tr valign="middle" bgcolor="#FFFFFF">
<td align="right" colspan="2" height="30" bgcolor="#FFFFFF">
<table width="355" border="0" cellspacing="0" cellpadding="1" align="center">
<tr>
<td width="24%" align="left" valign="middle">
<font face="Arial, Helvetica, sans-serif" size="2">User Name:</font>
</td>
<td width="76%" align="left" valign="middle">
<input type="text" name="UserId" size="8" maxlength="10" value="">
</td>
</tr>
<tr>
<td width="24%" align="left" valign="middle">
<font face="Arial, Helvetica, sans-serif" size="2">Password:</font>
</td>
<td width="76%" align="left" valign="middle">
<input type="hidden" name="Validate" value="1">
<input type="password" name="UserPassword" size="8" maxlength="10">
<input type="submit" name="submit" value="Login">
<input type="reset" name="clear" value="Clear Entry">
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</form>
</blockquote>
</td>
</tr>
</table>
</td>
</tr>
</table>
</body>
</html>


login.asp - Source Code

Summary listing

<%@LANGUAGE=VBscript enablesessionstate=true LCID=1033%>
<%With Response
.Buffer=true
.AddHeader "cache-control", "no-store, must-revalidate, private"
.AddHeader "pragma", "no-cache"
.ExpiresAbsolute = #January 1, 1990 00:00:01#
.Expires=Now()-1
End With%>
<%
'##BD Attempt to login a user. Login.asp performs all the required validation.
'##BD If the required login parameters are missing, the user is sent to the login
'##BD failure page. If the input form is missing information, a system error is generated.
'##RF Validate ^^ A semaphore flag used to ensure that the post is valid
'##RF UserId ^^The user name as entered
'##RF UserPassword ^^ The password the user entered. This is not encrypted at this point, beyond what SSL would achieve.
'##RR /LogonConfirmation.asp ^^ Inform the user that their login was successful.
'##RR /LogonFailure.asp ^^ Inform the user that their login failed.
'##Rqi /LogonConfirmation.asp ^^ user ^^ A simple user type directive for the destination
'##RR /SystemError.asp ^^ Indicate a system error has occured. For the purposes of this demo, a failed "validate".
'##SV LoginErrorMessage ^^ An error message to display to the user in the event they fail validation.

'Option Explicit
'Response.Buffer = false
Dim s
s = " = new object2 "
s = ""
Function baseURL (byval s)
baseURL = s
End Function

Class Login
Public Function Validate ( ByVal sUID, ByVal sPWD )
Dim bValid
' short cut validation

bValid = False
If Len(strUserID) > 0 And Len(sPassword) > 0 Then
bValid = True
End If
End Function

Public Function Login ( ByVal sUID, ByVal sPWD )
rem call the DB to actually login
End Function

End Class

With Request
If .Form ("Validate") = "1" Then
Dim strUserID
Dim sPassword
Dim blnDebugCheck
Dim strHomepage
Dim oLogin

strUserID = Trim(.Form ("UserId") & "")
sPassword = Trim(.Form ("UserPassword") & "")
Set oLogin = New Login

If oLogin.Validate ( strUserID, sPassword ) Then
If (Not oLogin.Login (strUserID, sPassword)) Then
Session("LoginErrorMessage") = "The user name and password do not match."
'Response.Redirect baseURL("/logonFailure.asp")
Else
'Response.Redirect pageSURL("/logonConfirmation.asp?user=known")
End if
Else Session("LoginErrorMessage") = "You must enter both a user name, and a password."
'Response.Redirect baseURL("/logonFailure.asp")
End if

Else
'Response.Redirect baseURL("/SystemError.asp")
End if
End With
%>
<html>
<script language=javascript version="<%=BrowserCaps%>" class="<%=foo%>">

// the common script elements
<%=CommonScript%>

function normal () {

}
// test single line comment <%=singlelinetest%> with nesting <%=secondvar%> with last bit

var sTest = "";
// test double line comment version 2
<%=nonesting%> var foo=true
var bar = "with for more";
/* blocked multiline */

function middle () {

}

</script>

<script language="vbscript">

Sub SimpleTest ()
For Each Item In Items
' do some looping in here
Dim sTest
sTest = """double quoted"""
Next
End Sub

</script>

<body>
Error: <%=Session("LoginErrorMessage")%>

<table border="0" cellpadding='0' cellspacing=0>
<!-- <a href="#"> dummy </a> --> -->
<tr bgcolor="#000000"><td nowrap width="10%" alt="some alternate text">&nbsp;&#09;</td></tr>
</table>

<table border="<%=var0%>" cellpadding='<%=var1%>' cellspacing=<%=var2%>>
<!-- <a href="#"> dummy </a> --> -->
<tr bgcolor="<%=var3%>" height=100% width=100%><td bgcolor=#FFFFFF>&nbsp;&#09;</td></tr>
</table>

</body>
<!-- <a href="<%=baseURL("foo.asp")%>"> dummy </a>

<a href="<%=baseURL("foo.asp")%>"> dummy2 </a>

--> -->

<!-- #include file=bad.inc" -->

</html>
<%
Response.End
%>


logonConfirmation.asp - Source Code

Summary listing

<%@LANGUAGE=VBscript enablesessionstate=false LCID=1033%>
<%
'##BD Notify the user that they're logged on
'##SV LoginName ^^ The user's login name
'##SV HomePage ^^ The user's personalized home page is stored here
'##FR Continue ^^ When the user clicks on the confirmation button, they are magically transported to their customized home page.
'##FV Continue ^^ BtnContinue ^^ The magic button
'##FM PreviousActions ^^ This frame provides the user with a history of their past actions.
'##FMV PreviousActions ^^ user ^^ The user for whom we are attempting to obtain the history
Option Explicit
Response.Buffer = false

Dim strPageTitle
Dim strUserName 'holds the user name (login name) from the session
Dim strLastLogin 'holds last login date formated to the locale
Dim strLastLogout 'holds last logout date formated to the locale
Dim strUserHome

strUserName = objSession("LoginName")
strPageTitle = "Login Confirmation"
strUserHome = objSession("HomePage")

%>
<html>
<head>
<title><%= strPageTitle %></title>
</head>
<body bgcolor="#FFFFFF" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0" text="#000000">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr><td valign="top"></td></tr>
<td valign="top">
<table width="446" border="0" cellspacing="0" cellpadding="5">
<tr>
<td width="446">
<blockquote>
<p><font face="Arial, Helvetica, sans-serif" size="4"><b><%= strPageTitle %></b></font></p>
<p><font face="Arial, Helvetica, sans-serif" size="2">
<%=strUserName%>, you have successfully logged in. <br></font></p>
</blockquote>
<form action="<%=strUserHome%>" method=post name=Continue>
<table width="355" border="0" cellspacing="0" cellpadding="0" align="center">
<tr align="center">
<td> <br>
<input type="submit" name="BtnContinue" value="Continue">
</td>
</tr>
</table>
</form>
</td>
</tr>
</table>
</td>
</tr>
</table>
<iframe name="PreviousActions" src="history.asp?user=<%=strUserName%>" height=33% width=100%></iframe>
</body>
</html>


logonFailure.asp - Source Code

Summary listing

<%@LANGUAGE=VBscript enablesessionstate=false LCID=1033%>
<%
'##BD Notify the user that their logon has failed.
'##AN Home ^^ The user gets to go back to the default page to login again.
'##RC Session ^^ The session cookie we are using.
'##RC Expired ^^ Have a cookie key to let us know what happened to the session.
'##RQ NoCheck ^^ Indicates if we should check and logout the user.
Option Explicit
Response.Buffer = false
Dim strPageTitle
Dim strNoCheck ' variable for use to determine if a prompt for login is required
Dim strPromptCount

strNoCheck = Request.QueryString("NoCheck") & ""
strPageTitle = "Login Failure"

If Len(strNoCheck) = 0 Then
objSession.Logout

Response.Cookies ("Session") = ""
Response.Cookies ("Expired") = "Failure"

End If

%>
<html>
<head>
<title><%= strPageTitle %></title>
</head>
<body bgcolor="#FFFFFF" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0" text="#000000">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr><td valign="top"></td></tr>
<td valign="top">
<table width="446" border="0" cellspacing="0" cellpadding="5">
<tr>
<td width="446">
<blockquote>
<p><font face="Arial, Helvetica, sans-serif" size="4"><b><%= strPageTitle %></b></font></p>
<p><font face="Arial, Helvetica, sans-serif" size="2">
Your login has failed.
Return <a href="<%=baseURL("/default.asp")%>">Home</a><br><br>
</font></p>
</blockquote>
</td>
</tr>
</table>
</td>
</tr>
</table>
</body>
</html>


SystemError.asp - Source Code

Summary listing

<%@LANGUAGE=VBscript enablesessionstate=false LCID=1033%>
<%

'##BD Displayed when another page has encountered an error indiciative of a possible system error. Allows the user to continue processing.
'##AN Home ^^ The link to the user's home page
'##QI Home ^^ PageId ^^ The root home page.

Option Explicit
Response.Buffer = true

Dim strPageTitle
Dim strHtmlMessage
Dim strId
strId = 1
strPageTitle = "Sorry, we are experiencing difficulties"
strHtmlMessage = "We're sorry. We apparently are experiencing some temporary difficulties."

%>
<html>
<head>
<title><%= strPageTitle %></title>
</head>
<body bgcolor="#FFFFFF" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0" text="#000000">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr><td valign="top"></td></tr>
<td valign="top">
<table width="446" border="0" cellspacing="0" cellpadding="5">
<tr>
<td width="446">
<blockquote>
<p><font face="Arial, Helvetica, sans-serif" size="4" color="#003366"><b><%= strPageTitle %></b></font></p>
<p><font face="Arial, Helvetica, sans-serif" size="2"><%= strHtmlMessage %></font></p>
<br><br>
<font face="Arial, Helvetica, sans-serif" size="2">Return </font><a href="default.asp?pageid=<%=strId%>"><font face="Arial, Helvetica, sans-serif" size="2">Home</font></a><br><br>
</blockquote>
<br>
<br>
</td>
</tr>
</table>
</td>
</tr>
</table>
</body>
</html>