Click here to Skip to main content
15,894,223 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
C#
public partial class Registration : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        if (IsPostBack)
        {
            SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["LearningConnectionString"].ConnectionString);
            conn.Open();
            string checkuser = "select count (*) from UserData where UserName='" + TextBoxUserName.Text + "'";
            SqlCommand com = new SqlCommand(checkuser, conn);
            int temp = Convert.ToInt32(com.ExecuteScalar().ToString());
            conn.Close();
            if (temp >= 1)
            {
                Response.Write("UserName already exists");
            }

        }
             
    }
    protected void Button_SignUp_Click(object sender, EventArgs e)
    {
        try
        {
            Guid NewGuid = Guid.NewGuid();

            SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["LearningConnectionString"].ConnectionString);
            conn.Open();
            string insertQuery = "insert into UserData(ID,Name,LastName,UserName,Email,Password,Gender,country,DateOfBirth) values (@ID ,@name ,@lastname ,@username ,@email ,@password ,@gender ,@country ,@dateofbirth)";
            SqlCommand com = new SqlCommand(insertQuery, conn);

            com.Parameters.AddWithValue("@ID", NewGuid.ToString());
            com.Parameters.AddWithValue("@name", TextBoxName.Text);
            com.Parameters.AddWithValue("@lastname", TextBoxLastName.Text);
            com.Parameters.AddWithValue("@username", TextBoxUserName.Text);
            com.Parameters.AddWithValue("@email", TextBoxEmail.Text);
            com.Parameters.AddWithValue("@password", TextBoxPassword.Text);
            com.Parameters.AddWithValue("@gender", DropDownListGender.SelectedItem.ToString());
            com.Parameters.AddWithValue("@country", DropDownListCountry.SelectedItem.ToString());
            com.Parameters.AddWithValue("@dateofbirth", TextBox_DOB.Text);

            com.ExecuteNonQuery();
            Response.Write("Your registration is successful");
            Response.Redirect("Login.aspx");

            conn.Close();
        }

        catch (Exception ex)
        {
            Response.Write("Error:" + ex.ToString());
        }
    
    }

}
Posted
Updated 20-Nov-14 9:10am
v2

1 solution

The things spring to mind:
1) You clearly know about parameterized queries, so why the heck are you concatenating strings to check if the username exists where it is the most dangerous? You leave yourself wide open to SQL injection which can damage or destroy your database, and nobody has to be logged in to do it!
2) Why do you take an integer value, convert it to a string, then convert it back to an integer again in order to check it?
int temp = Convert.ToInt32(com.ExecuteScalar().ToString());

And then - apart from telling the user it's in use, you don't actually do anything about it!
3) Please, never store passwords in clear text! It is a major security risk... See here: Password Storage: How to do it.[^]

So what are you doing here? Guessing? Copy and pasting without bothering to think about it? Or just throwing it together and hoping?

Stop, think, and try again.
But if you are trying to invent your own login system - and the rest of it continues in the same vein - than you have a complex, difficult to work with and probably very insecure website coming up...

Please, do yourself a favour, and use existing systems: Introduction to Membership[^]
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900