How do I find out which user is logged in

Question

0.00/5 (No votes)

See more:

I have a Login page. There is a table named user_privilege and column named user_type. There is two values in it Staff and Admin now i want to find out which user had logged in so we can let them in their respective areas. I am having hard time figuring out how

What I have tried:

protected void btnLogin_Click(object sender, EventArgs e)
        {
            using (SqlConnection con = new SqlConnection(@"Data Source =DESKTOP- 
            RVF1OET\SQLEXPRESS; Initial Catalog = ClothStockManagement; Integrated 
            Security = True;"))
            {
                con.Open();
                string query = "select count(1) from user_privilege where 
                user_id=@username and password=@password";

                string userType= "select user_type from user_privilege";

                SqlCommand cmd = new SqlCommand(query, con);
                cmd.Parameters.AddWithValue("@username", userNameBox.Text.Trim());
                cmd.Parameters.AddWithValue("@password", passwordBox.Text.Trim());
                int count = Convert.ToInt32(cmd.ExecuteScalar());
                if (count == 1)
                {
                 if (userType == "Staff")
                    {

                        messageBox.Text = "Staff";
                        Response.Redirect("test.aspx");
                        
                    }
                    else
                    {
                        Session["admin"] = userNameBox.Text;
                        Response.Redirect("AdminDashboard.aspx");
                        messageBox.Text = "Ad";
                    }
                }

                else
                {
                    messageBox.Text = "Failed";
                }
            }
        }

Posted 20-Apr-18 23:29pm

Subit Timalsina

Updated 20-Apr-18 23:45pm

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Wendelius · Accepted Answer · 2018-04-20T23:46:00

Solution 1

First of all, never store the passwords as plain text. Have a look at Password Storage: How to do it.[^]

About the question itself, instead of counting the records, select the actual data. In other words something like

C#

string query = "select user_type from user_privilege where 
                user_id=@username and password=@password";

You can then use SqlCommand.ExecuteReader Method (System.Data.SqlClient)[^] to run the query and investigate the data returned.

ADDITION

As a samll example of using a reader, consider the following. Note this doesn't fix the password problem.

C#

...
con.Open();
string query = "select user_type from user_privilege where user_id=@username and password=@password";

SqlCommand cmd = new SqlCommand(query, con);
cmd.Parameters.AddWithValue("@username", userNameBox.Text.Trim());
cmd.Parameters.AddWithValue("@password", passwordBox.Text.Trim());

SqlDataReader reader = command.ExecuteReader();
if  !(reader.Read()) {
   messageBox.Text = "User not found";
   Response.Redirect("test.aspx");
} else  if (reader[0].ToString() == "Staff") {
   messageBox.Text = "Staff";
   Response.Redirect("test.aspx");
} else  {
   Session["admin"] = userNameBox.Text;
   Response.Redirect("AdminDashboard.aspx");
   messageBox.Text = "Ad";
}

else
{
    messageBox.Text = "Failed";
}
...

Posted 20-Apr-18 23:46pm

Wendelius

Updated 21-Apr-18 0:53am

v4

Comments

Subit Timalsina 21-Apr-18 6:03am

Thanks a lot bro for the suggestion i will try performing hashing but this is my first time working with these kind of things can u provide it here if possible

Wendelius 21-Apr-18 6:09am

Not sure what you mean, the tip has some code almost ready to use.

Or are you referring to something else?

Subit Timalsina 21-Apr-18 6:15am

I tried it but it is not working
U meant this right
string userType = "select user_type from user_privilege where user_id =@username and password =@password";
SqlCommand cmd = new SqlCommand(userType, con);
cmd.Parameters.AddWithValue("@username", userNameBox.Text.Trim());
cmd.Parameters.AddWithValue("@password", passwordBox.Text.Trim());
int count = Convert.ToInt32(cmd.ExecuteScalar());

Wendelius 21-Apr-18 6:21am

The command looks better now. I would suggest trying to make it work first without worrying about the password. When you get the relevant data then concentrate on the password issue.

The problem with the password is not corrected only by making changes to the SELECT statement, you also need to modify inserting the data into the user_privilege table. This is why it's going to take some more effort to make it work.

Wendelius 21-Apr-18 6:23am

Oh, another thing, you're not getting the count anymore so don't try to use the return value like that. Take a look at the example in the MS docs I linked to the answer. It describes how to use Read method to read the rows.

Subit Timalsina 21-Apr-18 6:15am

I am new to c# sorry if i am really bad

Wendelius 21-Apr-18 6:28am

See the updated answer

Subit Timalsina 21-Apr-18 6:51am

it is throwing an error at the else if condition
Operator '==' cannot be applied to operands of type 'method group' and 'string'

Wendelius 21-Apr-18 6:53am

Seems that I forgot the parenthesis from the end of the ToString method call. Fixed now.