Question

I am trying to allow people to login using their UserID(int) or their username (string). The way I thought about doing this is creating two seperate methods, one that accepts a string, and one that accepts an int. But I could not get this to work and it seems there might be a better solution.

public static string ForgotPassword ( string username )
{
    using ( var conn = new SqlConnection( GetConnectionString() ) )
    using ( var cmd = conn.CreateCommand() )
    {
        conn.Open();
        cmd.CommandText =
        @"SELECT 
             Password 
         FROM 
             Distributor
         WHERE 
             Username = @username";
        cmd.Parameters.AddWithValue( "@username", (string)username );
        using ( var reader = cmd.ExecuteReader() )
        {
            if ( !reader.Read() )
            {
                // no results found
                return null;
            }
            return reader.GetString( reader.GetOrdinal( "Password" ) );
        }
    }
}

public static string ForgotPassword ( int username )
{
    using ( var conn = new SqlConnection( GetConnectionString() ) )
    using ( var cmd = conn.CreateCommand() )
    {
        conn.Open();
        cmd.CommandText =
        @"SELECT 
             Password 
         FROM 
             Distributor
         WHERE 
             DistributorID= @username";
        cmd.Parameters.AddWithValue( "@username", (int)username );
        using ( var reader = cmd.ExecuteReader() )
        {
            if ( !reader.Read() )
            {
                // no results found
                return null;
            }
            return reader.GetString( reader.GetOrdinal( "Password" ) );
        }
    }
}

What is the best way to allow them to login with a user_id or a username?

Answer 1

In your first method, I would get hold of the userId from that username, then pass that to the 2nd method.

If a username doesn’t match a UserID, then return an error in the same way you would if the UserID doesn’t exist.

public static string ForgotPassword ( string username )
{
    int userid = //Get userid from username
    return ForgotPassword(userid);
}

public static string ForgotPassword ( int username )
{
    using ( var conn = new SqlConnection( GetConnectionString() ) )
    using ( var cmd = conn.CreateCommand() )
    {
        conn.Open();
        cmd.CommandText =
        @"SELECT 
             Password 
         FROM 
             Distributor
         WHERE 
             DistributorID= @username";
        cmd.Parameters.AddWithValue( "@username", (int)username );
        using ( var reader = cmd.ExecuteReader() )
        {
            if ( !reader.Read() )
            {
                // no results found
                return null;
            }
            return reader.GetString( reader.GetOrdinal( "Password" ) );
        }
    }
}