I'll try and explain this to the best of my ability.

I have a site that is protected so only paying members can see the protected pages of the site. The method of protection my site uses only protects html and php files so I was not able to keep the messenger.cgi script from being run by non-members.

What I did is create a login page in HTML instead of using the login.htm template that used the cgi script. I changed the template login.htm to a meta tag 4 second redirect with the Error Field still at the top. This way if a member enter the wrong password or user name it would show the error message and then return the user to the HTML page in order to attempt a login again.

Although the login works great this way and will keep the vast majority of non-members from accessing this feature on the site, I found that the password question feature will not work with this setup. When the password is requested it takes the user to my modified login.htm template and just says at the top "Answer Question" (or something along those lines) before redirecting the user back to the login page.

What I would like to know is there some way to create another template or call the script so it will retrieve this information?

Why can't you run the messenger behind a protected realm using say, .htaccess for example?

I'm just another users, but when i site was in private-beta-testing mode, I disabled registration page and made it password protected.

I allowed all users to see the login page as usually. They need to register first anyway.

Which means for you, you can protect both the registration and the login page. Keep the rest the same? Just modify the login.htm template so it doesnt show the login form.

Then use a standard html file for your login, and password protect that page. This way if they load messenger.cgi it will show a index page without a login form, and trhey have to load your other login page in order to log in. Thats just 1 of many ideas.

Also, I found modding the script pretty easy to add my own templates.

I will try that since I am already using .htaccess to protect the site. It protects a members directory where the script also resides but this fix will be easier to mess with.