Background: I have a page were users can either make "public" or "private". The user can specify a list of people to view the page. The selected names are stored in a db as comma delimited. When I call the public/private page in question, I place the script below. It is based on the session name of the logged in user and a recordset which brings the comma delimited list of "authorized users.

The problem: I am using instr which searches for the first instance of a give string in another string. For example I log in with the user name of "dan", but the album will allow a different member to view named "daniel". Even though these are different names, the instr will find the instance of "dan" in the allowed user name "daniel"

Does anyone have a better approach? I think I'm headed in the right direction, its just not precise enough... Please help!!

If (rsAccess("USER_ACCESS")) = "2" Then
	If Session("username") = "" Then
	  Response.Redirect("/login.asp?error=1")
	Else
	  Dim begin, match_text, user_access, user_session 
		
	  begin = 1 
	  user_access = lcase(rsAccess("AUTH_USERS")) 
	  user_session  = Session(lcase("username"))
	  match_text = InStr(begin, user_access, user_session) 

		If match_text = 0 Then
		  Response.Redirect("/login.asp?error=2")
		End If
	End If
End If

Thinking at the keyboard so not tested.

function CheckUser(username,allowed)
dim usernames,i
usernames = split(allowed,",")
CheckUser = false
for i = 0 to ubound(usernames) 
    if lcase(username) = lcase(usernames(i)) then
       CheckUser = true
       exit for
    end if
next
end function

thanks for that Chris... I knew I could rely on you

I think we are on the right track, for some reason the script will only check and return the first value of the comma delimited field and I don't understand why...

Hmm Works ok for me with hardcoded values, possibly there are spaces being added in the CSV that is throwing it off. Such as if you concatenate the string with ", " (or similar) for ease of reading in the DB fields.
This would add a leading space to each name except the first one.

If that is the case;

function CheckUser(username,allowed)
dim usernames,i
usernames = trim(split(allowed,","))
CheckUser = false
for i = 0 to ubound(usernames) 
    if lcase(trim(username)) = lcase(usernames(i)) then
       CheckUser = true
       exit for
    end if
next
end function

should work.

Okay, well... it took a little head scratching, but I think its doing what I need it to do. I learned a lot from this... Thanks so much for getting me on the right track!!

<%
If rsAccess("USER_ACCESS) = "2" Then
  If Session("username") = "" Then
   	Response.Redirect "/login.asp?go=http://"&Request.ServerVariables("SERVER_NAME")&Request.ServerVariables("URL")&"?"&Request.ServerVariables("QUERY_STRING")
  Else
	usernames=rsAccess("AUTH_USERS") & "" 
	checkuser=false
	split_names=Split(usernames,",")
	for i=0 to ubound(split_names)
	if trim(lcase(split_names(i)))=lcase(session("username")) then
	checkuser=true
	Exit for
	end if
	next
	if checkuser then 
	checkuser=true 
	else 
	Response.Redirect "/error.asp?error=1"
	End If
  End If
End If
%>