Click here to Skip to main content
15,906,626 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
,GETDATE()) is the function of get current date but how to save the current date to database and the last logidate any simple ideas..?
Posted
Comments
[no name] 14-Apr-14 15:06pm    
Connect to whatever database you are using, write a query to insert or update the data, execute the query. DateTime.Now gives you the current date in C#.

1 solution

Well...GETDATE is the SQL function for the current date and has nothing to do with C#, but it works, yes - and it's a reasonably sensible function to use because it means all timestamps are set using the same clock.
So all you have to do is set up a simple SQL query to do an UPDATE:
SQL
UPDATE MyTable SET LastLoginDate=GETDATE() WHERE UserId=...
and supply your actual user identification information instead of the ellipsis.

The C# code is pretty trivial - it's exactly the same as your code for an INSERT, and (hopefully) uses a parameterized query - but I don't know which of the many ways to do that you are using, so I'll leave the exact implementation to you!


here is my login code where did i put "UPDATE MyTable SET LastLoginDate=GETDATE() WHERE UserId=... " code in


C#
protected void login_btn_Click(object sender, EventArgs e)
    {
        int cnt = 0;

        //  SqlDataAdapter ad1 = new SqlDataAdapter(@"select Id  from UserReg WHERE Name='" + TextBox1.Text + "' AND Password='" + TextBox2.Text + "'", con);
        //  DataTable dt = new DataTable();



        SqlCommand cmd;
        SqlDataReader dr;
        cmd = new SqlCommand("select Id  from UserReg WHERE Name='" + username.Text + "' AND Password='" + password.Text + "'");

        con.Open();
        cmd.Connection = con;
        cmd.ExecuteNonQuery();
        dr = cmd.ExecuteReader();
        while (dr.Read())
        {

            //  ad1.Fill(dt);
            cnt = Convert.ToInt32(dr["Id"].ToString());
        }

        if (cnt > 0)
        {
            Response.Redirect("profile.aspx?id=" + cnt); //Response.Redirect("veinpage.aspx?id=" + cnt);
        }

        else
        {
            loginchk.Text = "Invalid username or password";
            this.loginchk.ForeColor = Color.Red;
        }
        
    }
}



Oh dear...

Forget what you are trying to do with the updates, and have a good hard look at your code. Because what you have there my friend, is code that is supremely dangerous, and wide open to abuse.
For example, did you know I could log into your system without any password, or indeed username, for anywhere in the world? As anyone I wanted to? Or I could just delete your whole database without logging in? It's called SQL Injection, and you are wide, wide open to it.
In addition, you are storing passwords in clear text! Do you not read the news? Do you not understand how dangerous that is?

You seriously need to fix both of those - it isn't complex - and I would also recommend that you stop using a "home brewed" login system and look at Membership[^] - it's easy to follow and implement, and it gives you a lot better security than you are trying to implement.
But for goodness sake, use parameterised queries at all times - or your best friend will delete your DB just to see the look on your face!
Think I'm joking?
Try to log in with this username and no password:
x' OR Id > 0;--
 
Share this answer
 
v2
Comments
Bajpangosh 14-Apr-14 22:40pm    
here is my login code where did i put "UPDATE MyTable SET LastLoginDate=GETDATE() WHERE UserId=... " code in


protected void login_btn_Click(object sender, EventArgs e)
{
int cnt = 0;

// SqlDataAdapter ad1 = new SqlDataAdapter(@"select Id from UserReg WHERE Name='" + TextBox1.Text + "' AND Password='" + TextBox2.Text + "'", con);
// DataTable dt = new DataTable();



SqlCommand cmd;
SqlDataReader dr;
cmd = new SqlCommand("select Id from UserReg WHERE Name='" + username.Text + "' AND Password='" + password.Text + "'");

con.Open();
cmd.Connection = con;
cmd.ExecuteNonQuery();
dr = cmd.ExecuteReader();
while (dr.Read())
{

// ad1.Fill(dt);
cnt = Convert.ToInt32(dr["Id"].ToString());
}

if (cnt > 0)
{
Response.Redirect("profile.aspx?id=" + cnt); //Response.Redirect("veinpage.aspx?id=" + cnt);
}

else
{
loginchk.Text = "Invalid username or password";
this.loginchk.ForeColor = Color.Red;
}

}
}
OriginalGriff 15-Apr-14 4:50am    
Answer updated
Bajpangosh 15-Apr-14 9:30am    
thakq u r really awesome. it's just a college project. am not trying to host this code in web. and really thankful for mention the sql injection attack :)
Bajpangosh 15-Apr-14 9:33am    
oww... the code can bypass my login :( could you help me how too fix it.
OriginalGriff 15-Apr-14 10:28am    
If it isn't web - and ASP.NET implies it is, so please try to specifiy in future :) - then just use parametrised queries instead of concatenating your strings and you'll be fine.
You have been taught that, I assume? :laugh:

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900