Click here to Skip to main content
15,895,799 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
C#
protected void Button1_Click(object sender, EventArgs e)
        {

            SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["ABCConnectionString2"].ConnectionString);
            conn.Open();
            string chkuser = "select count(*) from Admin_login where uname='" + TextBox1.Text + "'  ";
            SqlCommand com = new SqlCommand(chkuser, conn);
            int temp = Convert.ToInt32(com.ExecuteScalar().ToString());
            conn.Close();
            if (temp == 1)
            {
                conn.Open();
                string checkpassword = " select pass from Admin_login where uname='" + TextBox1.Text + "'  ";
                SqlCommand PassCom = new SqlCommand(checkpassword, conn);
                string passwd = PassCom.ExecuteScalar().ToString().Replace(" ", "");
                if (passwd == TextBox2.Text)
                {
                    //Session["New"] = TextBox1.Text;
                    //Response.Write("password is correct");
                    Response.Redirect("Details.aspx");
                }
                else
                {
                    Response.Write("password is InCorrect");
                }
            }
            else
            {
                Response.Write("username is InCorrect");
            }
        }
    }
Posted
Updated 10-Apr-15 1:26am
v2

1 solution

"What Is Wrong Wd Ds"

Would you like a list?

Start with your incorrect use of case: It Isn't A Upper Case For Every Word. A sentence starts with Upper Case - after that it's Lower Case except for names.

Then, it's your dislike of vowels: "Wd Ds" - "with this".

"I M" should have an apostrophe: "I'm"

Do not concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.

Why convert a value to a string, and then immediately convert that to an integer?
C#
int temp = Convert.ToInt32(com.ExecuteScalar().ToString());
Instead, just cast the value:
C#
int temp = (int) com.ExecuteScalar();


Never store passwords in clear text - it is a major security risk. There is some information on how to do it here: Password Storage: How to do it.[^]

String.Replace replaces all instances, not just the ones at the ends. Use String.Trim for that.

Why close a connection, if you are about to immediately open it again?

Connections and Commands are scares resources - you are responsible for closing and disposing of them. The easiest way to do this is to use a using block.

And finally: look at your data. Use the debugger to follow your code through and look at exactly what is happening. We can't - we don't have access to your SQL server instance or your DB...
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900