Password match fields not working

[Peter Knowles]

I've been working on an online relational set of dbs using password fields to control who can edit records, and am having a devil of a time figuring out why it's not working. Here's a description of what I've done; maybe I'm approaching it all wrong, but in my mind and experience with FMP it seems like it SHOULD work. But this is my first attempt to use passwords in online forms and it doesn't seem to want to cooperate.

Here's the story. I have a small database for students which contains passwords they've entered, and another database for them to enter online journal writings. I have a relation set up between the two so that when a student creates a new journal record, they must enter a password, [password2] which is compared to the password [password1]in their student database record using a related field (Should it be a lookup instead?) . I have a field [passwordmatch] which calculates: If(password1 = password2, "true", "false"). Then, the format page has an If/Else form field. If [passwordmatch] = true (e.g., if the passwords match) they can access a text field for typing. If [passwordmatch] = false, the format page defaults to "Else" and a message that they've typed an incorrect password.

Everything works correctly, EXCEPT no matter what the two passwords say, the [passwordmatch] field always returns "False" even if the passwords match. So the reply on the format page is always "Sorry. incorrect password."

Everything works great if I make [passwordmatch] a calc field that simply says "true" (which, of course, makes the password concept irrelevant), so the glitch seems to be in the way the password from the related db is passed to the journal db for verification. Or is it?

I'm stumped. Any help is appreciated, especially if you have a better way to handle passwords in general.

NOTE: This is using password fields online, using CDML, not within FileMaker.

[Garry Claridge]

Are you using the "Web Security" database?

All the best.

Garry

[John Caballero]

Hi Peter,

What I did in a case similar to yours was to use a lookup. My Users db has a UserName, Password and UserID (auto-enter, serial) field, along with a calculated text field that is a concantentation of UserName and Password. My Login db has the same fields (except that the UserID is the lookup field). The log-in screen prompts the user to enter their UserName and Password. When they enter those two values and press the submit button a new record is created in my Login db. I have a relationship from my Login db to my User db based on the concantenated calc. If the user enters a correct UserName and Password, the relationship from the Login db to the User db is valid and the value in the UserID field in the Login db will be entered via the lookup. An incorrect UserName and/or Password will result in the creation of a record in the Login db with no value in the UserID field. My CDML checks for the existence of a value in the UserID field of the newly created record in the Login db and directs program flow accordingly.

[Jeff Spall]

Hi, would this work??

If your user logs on at the start of each session, set a session cookie with the userID

if you have the concatenated "username,password" field in your user database that John suggests you can use the userID to get the "username,password" and embed that as a hidden field into the journal record page so that it gets passed each time the record is created or updated.

Make your "username,password" concatenated field in the user database into a value list and use the "must be a member of the value list" validation. If it fails, FileMaker should return a "503" error code which you can use in an "If" statement to create an appropriate message.

regards, jeff