What Is Wrong With This Script?

[markster]

I have writtin a script that, when executed, will check the viewers username and password against a file called UserList.js. But it has an error every time i execute it.

Here is the content of the script:

<script language="javascript" type="text/javascript" src="UserList.js">
function login()
{
var loggedin = false
var userin = document.getElementById('user').value
var passin = document.getElementById('pass').value
for (i=0;i<users.length;i++)
{
if (userin==users[i][0] && passin==users[i][1])
{
loggedin = true
break
}
else {}
}
if (loggedin==true)
{
alert("yay")
}
else
{
alert("Wrong username/password")
}
}
</script>

And this is the content of UserList.js:

var users = new Array();
users[0] = new Array("admin_control","securepassword");
users[1] = new Array("buttercup","cadbury");
users[2] = new Array("charley","cookies");
users[3] = new Array("crewdesign","canoe");
users[4] = new Array("footymadfrostie","elliott");
users[5] = new Array("haneebee","haneebee123");
users[6] = new Array("henry","thomas");
users[7] = new Array("ieuan","rugby");
users[8] = new Array("johnskorczewski","webpromotionweekly");
users[9] = new Array("sormesher","telcora");
users[10] = new Array("mark","76715288");
users[11] = new Array("besty","miffy");
users[11] = new Array("guest","guest");
users[12] = new Array("boycee","select");
users[13] = new Array("kyleblakemore","cresswell");
users[14] = new Array("dc120","united1");
users[15] = new Array("steven","steven");
users[16] = new Array("sxctom06","6++569");
users[17] = new Array("bob","teggin987");
users[18] = new Array("richard","richard")

Please help!

[Redline]

I got it to work with this code

<script language="javascript" type="text/javascript" src="UserList.js"> </script>
<script language="javascript" type="text/javascript">
	function login() {
		var loggedin = false
		var userin = document.getElementById('user').value
		var passin = document.getElementById('pass').value
		for (i=0;i<users.length;i++) {
			if (userin==users[i][0] && passin==users[i][1]) {
				loggedin = true
				break
			} else {}
		}
		if (loggedin==true) {
			alert("yay")
		} else {
			alert("Wrong username/password")
		}
	}
</script>

Essentially specifying a source in a script tag seems to make it ignore everything within the opening/closing tags.

Now, using Javascript for user authentication is a major security problem. It's very easy for a user to view source, see where the user credentials are stored, and steal them. And your loggedin flag sits on the client. Seems too risky for me.

[markster]

THANKS! Dont worry, its not for anything major

[Redline]

Cool, no prob my friend