Click here to Skip to main content
15,889,867 members
Please Sign up or sign in to vote.
1.00/5 (4 votes)
See more:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Configuration;

namespace WebPage
{
public partial class Login : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{

}

protected void Button_LOGIN_Click(object sender, EventArgs e)
{
SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["regConnectionString"].ConnectionString);
conn.Open();
string checkuser = " select count(*) from UserDetail where UserName='System.Web.UI.WebControls.TextBox'";
SqlCommand com = new SqlCommand(checkuser, conn);
int temp = Convert.ToInt32(com.ExecuteScalar().ToString());
conn.Close();
if (temp == 1)
{
conn.Open();
string checkPasswordQuery = " select password from UserDetail where UserName='System.Web.UI.WebControls.TextBox'";
SqlCommand passComm = new SqlCommand(checkPasswordQuery, conn);
string password = passComm.ExecuteScalar().ToString().Replace(" ","");
if (password == TextBoxPASSWORD.Text)
{
Session["New"] = TextBoxUserName.Text;
Response.Write("Password is Correct");
Response.Redirect("Manager.aspx");
}
else
{
Response.Write("Password is Not correct");
}


}
else
{
Response.Write("Username is Not correct");
}
}
}
}
Posted
Comments
[no name] 13-Jul-14 7:41am    
And you are surprised by this? Do you actually have a user in your database named "System.Web.UI.WebControls.TextBox"?
Sneha_10 13-Jul-14 7:43am    
"UserName='System.Web.UI.WebControls.TextBox'"
Have you written this in your code or only in this question?

1 solution

When you posted this code earlier: System.Data.SqlClient.SqlExcep...[^]
I explained that that was what the code your were using was going to do:
C#
string checkuser = " select count(*) from UserDetail where UserName='" + TextBoxUN + "'";
And that you should change it to:
C#
string checkuser = " select count(*) from UserDetail where UserName='" + TextBoxUN.Text + "'";
But that was dangerous and you should use Parametrised queries instead.

Not that you should use the class name directly...:sigh:
Please, start to think about what you are doing? Please?
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900