Adding string on one variable in classic asp - string

Question

I'm trying logging verification, everything seems to be fine, but when I add the special characters string to another variable it causes an error to occur.
I'm trying to detect if a user is inputting special characters such as: !, . etc. something like that.
Here's my code,
<form action="" method="get"/>
username:<input type="text" name="user"/><br>
password:<input type="password" name="pass"/><br>
<input type="submit" value="Login">
</form>
<%
dim user,pass, spchar, getspchar
user=request.querystring("user")
pass=request.querystring("pass")
spchar = "!"
getspchar = spchar
if user = "" then
response.write("Please provide your first name")
elseif pass = "" then
response.write("Please provide your password")
elseif user = spchar or pass = spchar then
response.write(getspchar &" Special character not allowed")
elseif user <> "admin" or pass <> "admin" then
response.write("Invalid Username or Password")
else
response.write("welcome")
end if
%>

Answer 1

What you need to do is check to see if your special characters are in the list. Perhaps something like the following...
<%
Dim user, pass, specchars
'Put all your special characters in the following list...
user = Request.QueryString("user")
pass = Request.QueryString("pass")
specchars = "!£$%^"
If IsValid(user, specchars) And IsValid(pass, specchars) Then
Response.Write("Username and password are fine! Welcome!")
Else
Response.Write("Bad username or password.")
End if
'The reason I've given two arguments here is so that you can have different
'restricted characters for both the username and password...
Function IsValid(phrase, special)
Dim rv, c
For c = 1 to Len(specchars)
rv = (Instr(phrase, Mid(special, c, 1)) = 0)
Next
IsValid = rv
End Function
%>
Just as an aside, here, you're visually displaying your username and password in the query string which is tagged on to the end of your URL (something like www.example.com/default.asp?user=admin&pass=G0d); this isn't a good idea. Try at least using POST in your form instead of GET. If you do this, then you're going to have to look at changing to using Request.Form("controlname") ... and that's just scratching the surface.
Please remember that this is a very basic piece of code and I would not recommend using any structure like this for your security on the internet. You'll need to look into Secure Sockets Layer (SSL) and similar encryption.