Click here to Skip to main content
15,358,692 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
I have a code on the login page that will lock the account if the account gets 3 unsuccessful login attempts. The problem is that when a user tries to login with the same username but different password the account does not lock. I don't see the login attemps in the database. Please help me. What did I wrong?

C#
if (!IsPostBack)
        {
            Session["counter"] = 0;     
        }
        else
        {
            Session["counter"] = Convert.ToInt32(Session["counter"]) + 1;

            using (SqlConnection con = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["HotConnectionString"].ConnectionString))
            {
                con.Open();

                string cmdStr = "Select count(*) from Table22 where EmailAddress=@TextBoxEA";
                SqlCommand sqlCmd = new SqlCommand(cmdStr, con);
                sqlCmd.Parameters.Add("@TextBoxEA", TextBoxEA.Text);
                int userExists = (int)sqlCmd.ExecuteNonQuery();

                cmdStr = "Select count(*) from Table22 where EmailAddress = @TextBoxEA AND Password = @TextBoxPW";
                sqlCmd = new SqlCommand(cmdStr, con);
                sqlCmd.Parameters.Add("@TextBoxEA", TextBoxEA.Text);
                sqlCmd.Parameters.Add("@TextBoxPW", TextBoxPW.Text);
                int correctPassword = (int)sqlCmd.ExecuteNonQuery();

                

                string msg = "";
                if (userExists == 0)
                    msg = "alert('User Name Does Not Exist You Must Fill Out Registration First');";
                else if (correctPassword == 0)
                    msg = "alert('Invalid UserName / Password');";
                else if (Convert.ToInt32(Session["counter"]) >= 3)
                {
                    msg = "alert('The Account is Locked');";


                    cmdStr = "Update Table22 SET isLocked = true where EmailAddress = @TextBoxEA";
                    sqlCmd = new SqlCommand(cmdStr, con);
                    sqlCmd.Parameters.Add("@TextBoxEA", TextBoxEA.Text);
                    sqlCmd.ExecuteNonQuery();
                }
                if (msg.Length > 0)
                {
                    ScriptManager.RegisterStartupScript(this, this.GetType(), "script", msg, true);
                    TextBoxEA.Text = string.Empty;
                }
                con.Close();
            } 

        }
    }


New Error:

HTML
 Invalid column name 'true'.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.SqlClient.SqlException: Invalid column name 'true'.

Source Error:


Line 54:                     sqlCmd = new SqlCommand(cmdStr, con);
Line 55:                     sqlCmd.Parameters.Add("@TextBoxEA", TextBoxEA.Text);
Line 56:                     sqlCmd.ExecuteNonQuery();
Line 57:                 }
Line 58:                 if (msg.Length > 0)
Posted
Updated 29-May-14 5:44am
v2
Comments
CHill60 29-May-14 11:28am
   
Put a break point on Session["counter"] = Convert.ToInt32(Session["counter"]) + 1; and confirm that the counter is being incremented with each attempt.
Change the execute to int rows = sqlCmd.ExecuteNonQuery();. When the counter reaches 3 step through the code to that point and check the value of rows. What does it equal?
Computer Wiz99 29-May-14 11:42am
   
I have made the changes and made some changes to the changes. Now my message box will not display and I get this new error. I will update the solution.
CHill60 29-May-14 11:46am
   
Have you seen the solution I posted? I think that should clear it up

1 solution

Think I've found it in the line
SQL
cmdStr = "Update Table22 SET isLocked = true where EmailAddress = @TextBoxEA";

There isn't a Boolean column type per se in SQL - you need to use

a) (best way) BIT and set the value to 1 if True or 0 if False
SQL
cmdStr = "Update Table22 SET isLocked = 1 where EmailAddress = @TextBoxEA";

OR b) CHAR(1) and set the value to 'Y' if True or 'N' if False
cmdStr = "Update Table22 SET isLocked = 'Y' where EmailAddress = @TextBoxEA";

OR c) (Don't do this) VARCHAR(5) and set the value to 'True' or 'False'
cmdStr = "Update Table22 SET isLocked = 'True' where EmailAddress = @TextBoxEA";
   
Comments
Computer Wiz99 29-May-14 11:51am
   
Chill60, Thanks for the help but now I get the lock message with every username. Why?
CHill60 29-May-14 11:55am
   
Is Session["counter"] ever reset back to zero? Perhaps store "previous user" in Session also then if TextBoxEA.Text is different to previous user set the counter back to 0
Computer Wiz99 29-May-14 12:00pm
   
I am not clear on what you just said. And my Invalid Username / Password message is not popping up. Why?

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900