ASP.NET

23-Apr-07 21:57

This is the code in my login.ascx file.

<%@ Import Namespace="System.Data" %> <br />
<%@ Import Namespace="System.Data.Sql" %><br />
<%@ Import Namespace="System.Data.SqlClient" %><br />
<%@ Import Namespace="System.Data.SqlTypes" %><br />
<br />
<br />
<script language="C#" runat="server"><br />
    <br />
    public String RedirectPage ="Overzicht.aspx";<br />
    <br />
    public int chk;<br />
    <br />
    bool Authenticate(String user, String pass) <br />
    { <br />
	bool authenticated = false;<br />
	try <br />
	{ <br />
           String dsn = "server=localhost;uid=sa;pwd=;database=db";<br />
           //String sSQL = "SELECT emailadres,paswoord FROM tblPersoneelslid where emailadres='" + user.Trim() + "'";<br />
           String sSQL = "SELECT emailadres,paswoord FROM tblPersoneelslid WHERE (emailadres='" + UserName + "' AND paswoord='" + Password + "')";<br />
   	<br />
    SqlConnection Conn = new SqlConnection(dsn);     <br />
   	SqlCommand Cmd = new SqlCommand(sSQL,Conn);    <br />
	SqlDataReader Read1 = null;<br />
        <br />
	Conn.Open();<br />
<br />
    Read1 = Cmd.ExecuteReader();       <br />
	//Cmd.Execute(out Read1);<br />
        <br />
     if (Read1!=null){<br />
	<br />
	if (Read1.Read()) <br />
    { <br />
  		if (Read1.GetString(0)==user)<br />
        {<br />
			if(Read1.GetString(1)==pass){<br />
      				authenticated =true;<br />
        		}<br />
			else<br />
			{<br />
				chk=1;<br />
			}<br />
		}<br />
		else<br />
		{<br />
			chk=2;<br />
		}<br />
 	}<br />
      }<br />
           <br />
	}<br />
	catch(Exception e) <br />
    {<br />
		Response.Write("Foutmelding: " + e.ToString());<br />
	}<br />
<br />
	return authenticated;<br />
    }<br />
<br />
    private void SubmitBtn_Click(Object sender, EventArgs e) <br />
    {  <br />
       if (Authenticate(UserName.Text, Password.Value)) <br />
       { <br />
           Response.Redirect(RedirectPage);<br />
       }<br />
           <br />
       else <br />
       {<br />
		if (chk==1)<br />
        {<br />
			Message.Text="Paswoord ongeldig";<br />
			UserMark.Visible = false;<br />
			PasswordMark.Visible = true;<br />
           	Message.Visible = true;<br />
		}<br />
		else<br />
		{<br />
			Message.Text="Gebruikersnaam ongeldig";<br />
			PasswordMark.Visible = false;<br />
			UserMark.Visible = true;<br />
           	Message.Visible = true;<br />
		}<br />
       	}<br />
    }<br />
    <br />
</script>

and the error i get is:

Foutmelding: System.Data.SqlClient.SqlException: Login failed for user 'sa'. at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject) at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection) at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory) at System.Data.SqlClient.SqlConnection.Open() at ASP.login_ascx.Authenticate(String user, String pass) in d:\[ STAGE ]\Applicatie\WorkflowLibrary1\WebSite1\login.ascx:line 28

can someone help me with this problem?

-- modified at 4:07 Tuesday 24th April, 2007

szukuro23-Apr-07 22:25

23-Apr-07 22:25

Problems I noticed:
1. You're trying to log on to an SQL Server with 'sa' credentials.
2. You're code is open for SQL Injection.
3. SqlConnection should be opened in a try-catch block.
4. SqlDataReader should be closed after you retrive the data (either explicitly, or by specifíing the whole thing in a using statement.)
5. You just check is the SqlDataReader is created, but not if there's anything to read, so if there's no data, the GetString method will throw an excpetion.
6. You're using an unnecessary global variable chk.
7. You're shouldn't specify if the username or the password was incorrect. Just use some generic error message.
8. Don't let the user see the stack trace of an exception if thrown.

daviperke23-Apr-07 22:57

23-Apr-07 22:57

ty for the answer, but i have a new question now, i looked up for some new code and found this:
my login.aspx file:

<%@ Page Language="C#" %><br />
<%@ Import Namespace="System.Data" %><br />
<%@ Import Namespace="System.Data.OleDb" %><br />
<%@ Import Namespace="System.Web.Security" %><br />
<%@ Register TagPrefix="MySite" TagName="Login" Src="login.ascx" %><br />
<br />
<script language="C#" runat="server"><br />
private void Page_Load(Object sender, EventArgs E) <br />
{<br />
if ((Page.IsPostBack) && (Page.IsValid)) {<br />
   string strDSN = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=C:\\Membership.mdb";<br />
   string strSQL = "SELECT userName, userPassword FROM Membership WHERE userName='" + MyLogin.UserId + "'";<br />
<br />
   OleDbConnection myConn = new OleDbConnection(strDSN);<br />
   OleDbCommand myCmd = new OleDbCommand(strSQL, myConn);<br />
   OleDbDataReader dr = null;<br />
   try {<br />
    myConn.Open();<br />
    dr = myCmd.ExecuteReader();<br />
<br />
    if(dr.Read()) {<br />
        if(dr.GetString(1).Trim() == MyLogin.Password.Trim()) <br />
        {<br />
               FormsAuthentication.RedirectFromLoginPage(MyLogin.UserId, false);<br />
        }<br />
        else<br />
                   Message.Text = "Login mislukt. Probeer opnieuw";<br />
    }<br />
    else<br />
    {<br />
        Message.Text = "Login mislukt. Probeer opnieuw";<br />
    }<br />
   }<br />
   catch(Exception myException) {<br />
    Response.Write("Oops. The error: " + myException.Message);<br />
   }<br />
   finally {<br />
    myConn.Close();<br />
}<br />
}<br />
}<br />
</script><br />
<html><br />
<body><br />
<h3>Login</h3><br />
<form runat="server" ID="Form1"><br />
<asp:Label id="Message" runat="server" /><br />
<MySite:Login id="MyLogin" BackColor="#FFFFCC" runat="server"/><br />
</form><br />
</body><br />
</html>

Is it possible to work with a OleDbConnection to connect to a SQL database?

thanks in advance

szukuro23-Apr-07 23:18

23-Apr-07 23:18

daviperke wrote:
Is it possible to work with a OleDbConnection to connect to a SQL database?

Yes it is, but it's not recommended.
Note that in your new code problems 2 and 4 still remain. To solve 2 use a parametrized query and SqlParamaters. To solve 4 in the finally block write:

if (dr != null) dr.Close();

Also I don't recommend writing out any exception info. Use user-friendly messages to hide technical details.

daviperke23-Apr-07 23:40

23-Apr-07 23:40

Error: Could not use ''; file already in use.

this is the error i get when i fill in something and press login

code:

<%@ Page Language="C#" %><br />
<%@ Import Namespace="System.Data" %><br />
<%@ Import Namespace="System.Data.OleDb" %><br />
<%@ Import Namespace="System.Web.Security" %><br />
<%@ Register TagPrefix="MySite" TagName="Login" Src="login.ascx" %><br />
<br />
<script language="C#" runat="server"><br />
    <br />
private void Page_Load(Object sender, EventArgs E) <br />
{<br />
if (Page.IsPostBack) //&& (Page.IsValid)) <br />
{<br />
   string strDSN = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=D:\\sql server 2005\\MSSQL.1\\MSSQL\\Data\\db.mdf";<br />
   string strSQL = "SELECT emailadres, paswoord FROM tblPersoneelslid WHERE emailadres='" + MyLogin.UserId + "'";<br />
<br />
   OleDbConnection myConn = new OleDbConnection(strDSN);<br />
   OleDbCommand myCmd = new OleDbCommand(strSQL, myConn);<br />
   OleDbDataReader dr = null;<br />
<br />
   try<br />
   {<br />
       myConn.Open();<br />
       dr = myCmd.ExecuteReader();<br />
<br />
       if (dr.Read())<br />
       {<br />
           if (dr != null) dr.Close();<br />
           {<br />
               if (dr.GetString(1).Trim() == MyLogin.Password.Trim())<br />
               {<br />
                   FormsAuthentication.RedirectFromLoginPage(MyLogin.UserId, false);<br />
               }<br />
               else<br />
               {<br />
                   Message.Text = "Login mislukt. Probeer opnieuw";<br />
               }<br />
           }<br />
       }<br />
       else<br />
       {<br />
           Message.Text = "Login mislukt. Probeer opnieuw";<br />
       }<br />
<br />
   }<br />
   catch (Exception myException)<br />
   {<br />
       Response.Write("Foutmelding: " + myException.Message);<br />
   }<br />
   finally<br />
   {<br />
       myConn.Close();<br />
   }<br />
}<br />
}<br />
</script>

szukuro24-Apr-07 1:04

24-Apr-07 1:04

You can't connect to the database file itself, unless it is detached from SQL Server.
In my previous post I meant using OleDbConnection just like SqlConnection, that is connecting to the server.

daviperke24-Apr-07 1:33

24-Apr-07 1:33

hmmm, my knowledge about SQL server is very bad, how can you detached the file from SQL server?

szukuro24-Apr-07 3:35

24-Apr-07 3:35

Apart from the fact that you probably shouldn't do it this way - In Object Explorer right-click on the database and then select Tasks->Detach...

daviperke25-Apr-07 23:02

25-Apr-07 23:02

hmmmm, i found another article about login control:
http://support.microsoft.com/kb/Q301240[^]

when i do all this, i don't get any error, but i can't login :s nothing happens when i press logon.

What can be the problem of this?

szukuro26-Apr-07 1:28

26-Apr-07 1:28

This article contains some bad practises, for example storing password in plain text, not separating Data Access from business logic or not closing a SqlConnection properly (should be done in a finally block). I also don't understand why simple html controls with runat="server" are used, instead of just using server controls like Textbox or Button. Honestly I'm surprised this was published on a Microsfot site.
To get back to your problem - you didn't describe your problem well enough, so I have no idea what could be wrong. Are you using ASP.NET 1.1 or 2.0? If the latter is the case you might want to consider using the new Membership provider (Google for 'ASP.NET membership', and you'll find many resources about the subject).

daviperke26-Apr-07 1:36

26-Apr-07 1:36

ty for the help, this asp?net membership seems very usefull.

i'm trying to make a login control on a ASP.NET website and also a login control on a Winform, both in C#.

it's difficult for me, but i don't give up Wink | ;)

szukuro26-Apr-07 2:31

26-Apr-07 2:31

Good luck!

daviperke26-Apr-07 2:38