ASP.NET

8-Dec-09 23:06

I have made login page...
And i'm taking the values from the 'tbLogin' table.
there are, for instance 5 entries in the table ...And i'm entering three entries out of 5...they are working fine but when I try to enter other two entries ....login form doesn't pick'em ..what could be the error ..plz help ..The coding for the login form is :

public partial class _Default : System.Web.UI.Page
{
SqlConnection con;
SqlCommand cmd;
protected void Page_Load(object sender, EventArgs e)
{
if (!this.IsPostBack)
ViewState["LoginErrors"] = 0;
}

if (validateFunction(Login1.UserName,Login1.Password))
{
Response.Redirect("gallery.aspx?Name=" + Login1.UserName);
}

}

protected void Login1_Authenticate(object sender,AuthenticateEventArgs e)
{
if (validateFunction(Login1.UserName, Login1.Password))
{
Session["UserName"] = Login1.UserName.ToString();
Login1.Visible = false;
Response.Redirect("gallery.aspx?Name=" + Login1.UserName);

}
else
{
e.Authenticated = false;
}

}

private bool validateFunction(string username, string password)
{
bool returnval = false;
string strConnection = "Server=.\\sqlexpress;Integrated Security=true;Initial Catalog=dbLogin";
con = new SqlConnection(strConnection);
String sqlQuery = "SELECT UserName, password FROM tbLogin WHERE UserName='" + username + "' and password='"+password + "'";
cmd = new SqlCommand(sqlQuery, con);
Session["UserName"] = Login1.UserName.ToString();
SqlDataReader dtr;
con.Open();
dtr = cmd.ExecuteReader();

while (dtr.Read())
{
if ((username == dtr["UserName"].ToString()) & (password == dtr["password"].ToString()))
{
returnval = true;

}
dtr.Close();
return returnval;
}
return returnval;
}

protected void login_error(object sender, EventArgs e)
{
if (ViewState["LoginErrors"] == null)
ViewState["LoginErrors"] = 0;
int errorcount = (int)ViewState["LoginErrors"] + 1;
ViewState["LoginErrors"] = errorcount;

if ((errorcount > 3) && (Login1.PasswordRecoveryUrl != string.Empty))
{
Response.Redirect(Login1.PasswordRecoveryUrl);
}
}

the table "tbLogin" columns are:
UserName,
Password
UserId

plz help in finding the error

Blue_Boy8-Dec-09 23:34

Blue_Boy

8-Dec-09 23:34

Which error message do you get?
By the way, use stored procedures with parameteres to prevent SQL Injection.

I Love T-SQL
"Don't torture yourself,let the life to do it for you."
If my post helps you kindly save my time by voting my post.

www.aktualiteti.com

Amit Spadez9-Dec-09 0:10

9-Dec-09 0:10

error is that I could not retrieve all the records from the table..Instead, some of them are used perfectly.but some are not.

For instance, there are 3 records in the table "tbLogin".
Now 2 records are taken well in the login page .but last entry has not been taken by it ..

Dinesh Mani9-Dec-09 0:36

9-Dec-09 0:36

Since you are using the username and password directly in the select query your query might fail if there is any mismatch between the input and the database value. Depending on the server's case sensitivity settings, 'ABC' might not be equal to 'abc'. Also check if your passwords match exactly, no spaces on the ends.

Also, your design is perfect for SQL injection. You need to atleast sanitize your data before using it in your query! A better suggestion would be to use stored procedures.

If you cannot do either of this just get the userid and password based on just the user id. Then check the user password against the database password in code, just like its done now. Even here you need to sanitize the username before you use it in your query.

Amit Spadez9-Dec-09 0:42

9-Dec-09 0:42

username and passwords are both in small letters and I'm entering the same values in the login form ...but some of them are being run successfully and some are not run..
wat could be the other solution.
my coding is also sanitised as its not on a large scale rite now ..its a small project..And I'm just pracising for building the login web page in asp.net using C#

Dinesh Mani9-Dec-09 0:46

9-Dec-09 0:46

We cannot identify the error with this information. As far as I can see this is a data issue and not a code issue. Try this -

Put a breakpoint on your code after the query generation line and get the query that is to be executed. Examine the query and the data. If it is just test data, then post your query and the data here.

Amit Spadez9-Dec-09 0:49

9-Dec-09 0:49

I have done that .And the error is in the SQldatareader .
SQlDataReader's Object doesn't take the right username and password. wat to do to remove this error?

Dinesh Mani9-Dec-09 0:52

9-Dec-09 0:52

As in the username and password in the query is different from the ones you entered on screen?

Can you post some sample data?

Amit Spadez9-Dec-09 0:56

9-Dec-09 0:56

ya sure...
for instance, in the "tbLogin" table .there are records as the following:

UserId UserName Password

12 rahul rahul
143 amit amit
32 rajni rajni
543 anuj anuj

Among the above records, usernames "amit" , "rahul" and "anuj" are working fine but the username "rajni" and its corresponding password is not being taken by the login form.
I hope u understand the problem now

Dinesh Mani9-Dec-09 1:01

9-Dec-09 1:01

What is the query text when you try rajni in the login form?

Amit Spadez9-Dec-09 1:19

9-Dec-09 1:19

its the following :

string str = "Select userName, Password FROM tbLogin
Where userName= '" + txtUserName.Text + "' and Password = '" + txtPass.Text + "' ";

Dinesh Mani9-Dec-09 1:20

9-Dec-09 1:20

Buddy, I want the query text and not the code!

Amit Spadez9-Dec-09 1:21

9-Dec-09 1:21

what do u mean by query text ...i don't understand

Dinesh Mani9-Dec-09 1:29

9-Dec-09 1:29

Once the line of code where you form the query is executed, the string variable str would contain the query in plain text. You need to check that to find out what query is executed against the database table!

Now in your IDE, put a breakpoint on this line of code, execute your application and step through to get the value in str variable. Once you do that post it here.

Amit Spadez9-Dec-09 1:53