ASP.NET

write a single test page with complete diagnostic.

write a single test page with complete diagnostic.

protected void btnLogin_Click(object sender, EventArgs e)<br />
    {<br />
        if (Session["Admin"] != null)<br />
        {<br />
            if (txtPassword.Text.ToUpper.Equals(Session["Admin"]))<br />
                Response.Redirect("Homepage.aspx");<br />
        }<br />
        String except = null;<br />
        <big>DataValidation dv = new DataValidation();</big>        String pass = txtPassword.Text;<br />
<br />
        String password = null;<br />
        <br />
        password = dv.loginIn(txtUserName.Text);<br />
        <br />
        if (password==null)<br />
        {<br />
            //Session["Exception"] = except;<br />
            Session["SourceFile"] = Formname;<br />
            Response.Redirect("Error.aspx");<br />
            txtUserName.Text = "Exception";<br />
        }<br />
<br />
        else if (password.Equals(pass))<br />
        {<br />
            //txtUserName.Text = "Success";<br />
            Session["User"] = txtUserName.Text;<br />
            if (Session["User"].ToString().ToUpper().Equals("ADMIN"))<br />
                Session["Admin"] = "ADMIN";<br />
            Response.Redirect("Homepage.aspx");<br />
<br />
        }<br />
        <br />
        else <br />
        {<br />
            lblCheck.Text="Invalid UserName or Password";<br />
            //Response.Redirect("LogIn.aspx");<br />
        }<br />
<br />
<br />
<br />
    }

public String loginIn(String userName)<br />
    {<br />
        String queryBuilder;<br />
        <br />
        {<br />
            DataBaseConnection ds = new DataBaseConnection();<br />
<br />
            queryBuilder = "SELECT Password FROM User_Master WHERE UserName = @uname";<br />
<br />
            String pass = ds.loginDataBase(userName, queryBuilder);<br />
<br />
            return pass;<br />
        }<br />
<br />
    }

SqlConnection getConnection()<br />
    {<br />
        SqlConnection cn = null;                <br />
        {<br />
            cn = new SqlConnection();            <br />
            cn.ConnectionString = ConfigurationManager.ConnectionStrings["ConnectionString"].ToString();<br />
            return cn;                     <br />
        }<br />
    }<br />
<br />
<br />
<br />
    public String loginDataBase(String userName, String queryBuilder)<br />
    {<br />
        SqlConnection sqlcon = null;<br />
        try<br />
        {<br />
            sqlcon = new SqlConnection();<br />
            sqlcon.ConnectionString = ConfigurationManager.ConnectionStrings["ConnectionString"].ToString();<br />
            sqlcon.Open();<br />
<br />
            SqlCommand cmd = new SqlCommand();<br />
<br />
            cmd.CommandText = queryBuilder;<br />
            cmd.CommandType = CommandType.Text;<br />
            cmd.Connection = sqlcon;<br />
<br />
            cmd.Parameters.AddWithValue("@uname", userName);            <br />
           <br />
            SqlDataReader dr = cmd.ExecuteReader();<br />
            if (dr.HasRows == true)<br />
            {<br />
                dr.Read();<br />
                return dr[0].ToString();<br />
            }<br />
            else<br />
                return null;<br />
           <br />
        }<br />
<br />
        catch (Exception ex)<br />
        {<br />
            //except = ex.ToString();<br />
            return null;<br />
        }<br />
        finally<br />
        {<br />
            sqlcon.Close();<br />
        }<br />
    }

catch (Exception ex)
           {
              // except = ex.ToString();
               throw;
           }

indian143 wrote:

System.Net.WebException: The remote server returned an error: (407) Proxy Authentication Required..

indian143 wrote:

Thanks for your support, which country are you in now

indian143 wrote:

Do I have to set any properties at the time of Web Referencing

Figmo2 wrote:

I have ControlParameter tied to a textbox

Figmo2 wrote:

If I code my SelectCommand to look like ......WHERE Field LIKE @value It will work perfectly if I manually type the % signs in the text box for value. Including if I type %O'Hara% (the single quote no longer chokes it since I'm not concatenating anymore) - but obviously I don't want to have to teach the world to always put % sings at the start and end of their search strings on my web site.

protected void SqlDataSource1_Selecting(object sender, SqlDataSourceSelectingEventArgs e)<br />
{<br />
    e.Command.Parameters["@SearchExpr"].Value = "%" + e.Command.Parameters["@SearchExpr"].Value + "%";<br />
}

Figmo2 wrote:

Am I right in assuming that this should be adequate protection?