matching username and password in asp.net

Question

3.67/5 (2 votes)

See more:

in my login page i have the following code

C#

SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["ConnectionString"].ToString());
        SqlCommand comand = new SqlCommand("Select UserName,Password FROM Users WHERE UserName=@Uname and Password = @Pass", con);
        comand.Parameters.AddWithValue("@Uname", this.txtUsername.Text);
        comand.Parameters.AddWithValue("@pass", this.txtPassword.Text);
        con.Open();
        SqlDataAdapter adpter = new SqlDataAdapter(comand);
        DataTable dt = new DataTable();
        adpter.Fill(dt);
        
        if (dt.Rows.Count < 0)
        {
            this.Label1.Text = "Login Failed!<br /> Username or Password is not correct";

        }
        else
        {

            Session["Logged"] = "Yes";
            Session["User"] = this.txtUsername.Text;
            Response.Redirect("Main.aspx");
        }

it allows access to the "Main.aspx" page even username and password entered in textboxes are not present in the database
how i can match the username password enterd in the textbox with those values retrived from database?

Posted 4-Feb-14 19:19pm

irfanniazi

Updated 4-Feb-14 19:46pm

Sampath Lokuge

v2

Add a Solution

Comments

Sampath Lokuge 5-Feb-14 1:48am

Can you put the code snippet where you access this functionality ?

3 solutions

Solution 2

C#

foreach(DataRow row in dt.Rows)
     {
         if(row["UserName"].ToString() == this.txtUsername.Text && row["Password"].ToString() == this.txtPassword.Text )
         {
           Session["Logged"] = "Yes";
           Session["User"] = this.txtUsername.Text;
           Response.Redirect("Main.aspx");
         }
         else
         {
           this.Label1.Text = "Login Failed!
           Username or Password is not correct";
         }
     }

Friend, the way you are using to fetch data from DB is insecure. You should use stored-proc.

Posted 4-Feb-14 19:48pm

Hiren2 P

Updated 4-Feb-14 19:55pm

v2

Solution 3

Change this

C#

if (dt.Rows.Count < 0)
     {
         this.Label1.Text = "Login Failed!<br /> Username or Password is not correct";

     }
     else
     {

         Session["Logged"] = "Yes";
         Session["User"] = this.txtUsername.Text;
         Response.Redirect("Main.aspx");
     }

to

C#

if (dt.Rows.Count <= 0)
       {
           this.Label1.Text = "Login Failed!<br /> Username or Password is not correct";

       }
       else
       {

           Session["Logged"] = "Yes";
           Session["User"] = this.txtUsername.Text;
           Response.Redirect("Main.aspx");
       }

Posted 4-Feb-14 19:58pm

Tom Marvolo Riddle

Add a Solution

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

JoCodes · Accepted Answer · 2014-02-04T19:47:00

Solution 1

Check the if condition, this allows the user to enter the else part if dt.Rows.Count == 0 to

if (dt.Rows.Count < 0)

Change above to

if (dt.Rows.Count ==0)
{
//Not allowed code
}
else if ((dt.Rows.Count >0)
{
//Allow Navigation to MainPage code

}

Posted 4-Feb-14 19:47pm

JoCodes

Updated 4-Feb-14 19:48pm

v2

matching username and password in asp.net

3 solutions

Solution 2

Solution 1

Solution 3

Add your solution here

Preview 0

matching username and password in asp.net

3 solutions

Solution 2

Solution 1

Solution 3

Add your solution here

Preview 0

Existing Members

...or Join us