Advice on session timeout

Yup, do it in global.asa !

There\'s an event in there called Session_OnEnd that\'s fired when you call Session.Abandon or when the user session times out (default timeout is 20 minutes).

It works perfectly on IIS5, however I\'ve heard rumors of problems on IIS4. I use it myself to send the user an e-mail when he/she leaves my site (www.SpilNu.dk).

/SørenS

Hi there SørenS
I set up my global like this however it I recieve a server error


Sub Session_OnEnd

    Application.Lock
        Application(\"ActiveUsers\") = Application(\"ActiveUsers\") - 1
    Application.UnLock

    Set Conn = Server.CreateObject(\"ADODB.Connection\")
Conn.Open \"DRIVER={Microsoft Access Driver (*.mdb)}; DBQ=\" & server.MapPath(\"emne_under_emne/admin/db/admin_writers.mdb\")
SQLstmp = \"UPDATE DISTINCTROW writers SET online_status = \'\"Offline\"\' WHERE name = \" & session(\"name\")
response.write SQLstmp
Conn.Execute (SQLstmp)
conn.Close
Set conn = nothing
Set SQLstmp = nothing


End Sub

there is probably a serious error in my script but I havnt tried to insert a db connection in a golbal.asa file before

Any ideas
Guzzie

Check the NT event viewer, there\'s usually a pretty good error message in there, with line no. and all.

Can\'t remember it exactly, but I think it\'s in the Application log.

Two other things:

1)
I\'ve had some bad experiences with Server.MapPath in global.asa, especially with the Sesison_OnStart event.

Everything works fine if the user enters the site via the frontpage, but if the users entry point is in a sub directory ie. myweb.dk/forum, the Server.MapPath srews it up.

I\'m not sure if this is the case with the OnEnd event too, but the Event log should give you some clues with what goes wrong.

2)
You should do a check for if the Session(\"name\") has been set.

What happens if the user enters your site, doesn\'t log on, and then leaves?

Hope this helps :o)

/SørenS

Thanks soerns

I got now there was an error in my db connection
It seems to have accepcted it now though :)

Thanks for the advice
Guzzie

Np ;-)

Btw, I think there\'s a serious security \"issue\" with your database.

If it\'s placed in say www.myweb.dk/emne_under_emne/admin/db/admin_writers.mdb EVERYONE can download it!! Offcourse they have to know the path + name of the database, but mostly it\'s not very hard for a \"hacker\" to guess.

There\'s 2 solutions to this:

1)
Place your .MDB file outside your web, fx. in a c:\\inetpub\\db\\ folder.

2)
If your host doesn\'t offer you a way to do the above, then use this one. Simply rename your .MDB to .ASP! The Connection object doesn\'t care what the file extension is it\'ll connection to just about anything. If a user on the other hand tries to \"download\" it directly, the ASP parser will intercept it and try to translate it (which offcourse fails as there\'s no valid asp-code in a mdb file).

Feel free to ask, if you wanna know more \'bout the above.

/SørenS

thanks again sørens
will try that
Guzzie