html - Stop a session being overwritten -

I have a code that generates random numbers between 1 and 1000. It then stores that session as a session. You will then receive an email from the printed session in a form and submit it, but the problem occurs when you submit a form (two on the page) refreshes this random number and making the session invalid Reset

HTML

  & lt; Form action = "cantaccess.asp" method = "post" & gt; & Lt; P & gt; Email: & lt; Input type = "text" name = "inputtedEmail" value = "" /> & lt; / P & gt; & Lt; Input type = "submit" name = "submitEmail" value = "submit" /> & Lt; / Form & gt; & Lt; Form action = "cantaccess.asp" method = "post" & gt; & Lt; P & gt; Code: & lt; Input type = "text" name = "inputted code" value = "" /> & Lt; / P & gt; & Lt; Input type = "submit" name = "submitcode" value = "submit" /> & Lt; / Form & gt;  

ASP

  declares the variable for the random number that will be sent and the blank unique code ' Random generator random () 'GenCating a random number between 1 and 1000 unique code = CINT (int ((1000 * Rnd ()) 1) Write it for the answer to the test purposes. Write (Unique Copy) 'to save the code as a one-time Session ("parent code") to save the code = Unique session session. Timeout = 1  

I think the main problem you have is that the session timeout (After standard 20 minutes) you do not have access to the random number sent because you only store it in a session variable.

Now the only way for a user to access his page is when he receives an email with the "code" within the timeout value of the session and during that time your site is again Reviews.

To continue with that number and email address in any other way (e.g., database).

If you really want to apply it, as you describe the solution for, then you have to check whether the form field "input" value is present. If this is present then you should not generate a random number.

  if request.form ("inputted") & lt; & Gt; "" And numerical (request.form ("inputted") and request.form ("input")> gt; = 1 and request.form ("inputted") & lt; = 1000 Then if request.form ("inputted") = session ("generated") then 'session value and input value are equal, but you are not sure that the user you sent has been entered in your form ! End if other 'generates random numbers and store it and send email end if  

Another thought: Do you have a random number of inputs for that e-mail address Do you check that you sent? Otherwise I can try to fill the form and put in some number and access the taboo page without receiving the email with the "code". 1000 possibilities are not too much.