Question

I’ve made a basic Login Page using textboxes. I’m validating the users from the database created. Below is my backend code:

protected void btnSubmit_Click(object sender, EventArgs e)
{
    SqlDataReader sdrDatanew = null; //Read rows one by one.
    string strnew;
    string connectionString = WebConfigurationManager.ConnectionStrings["Gen_LicConnectionString"].ConnectionString; //Define new connectionstring
    SqlConnection connew = new SqlConnection(connectionString); //establishes a new sql connection
    connew.Open(); //Opens Connection
    strnew = "select User_Type from User_Details where User_Type='" + ddlUserSel.SelectedItem.Value + "' AND LoginID = '" + txtUserName.Text + "' AND Password = '" + txtPassword.Text + "'";
    SqlCommand sqlCommnew = new SqlCommand(strnew, connew); //passes the command and connection
    sdrDatanew = sqlCommnew.ExecuteReader(); //For select command

    int userType = 0;

    if (sdrDatanew.HasRows)
    {
        if (sdrDatanew.Read())
        {
            userType = Convert.ToInt32(sdrDatanew["User_Type"].ToString());
        }
    }

    switch (userType)
    {
        case 0:
            Response.Redirect("Lic_Gen.aspx");
            break;
        case 1:
            Response.Redirect("Cust_Page.aspx");
            break;
        default:
            lblDisp.Text= "Invalid User/Password";
            break;
    }

    connew.Close();
}

This is my frontend code:

<div>
    <h2 class="style12">
        LOGIN</h2>
    <p class="style10">
        &nbsp;</p>
    <table align="center" cellpadding="2" cellspacing="5" style="border-width: thick;
        border-style: outset; height: 195px;" class="style14">
        <tr>
            <td class="style16" style="border-style: none; font-family: 'Times New Roman', Times, serif;
                font-size: 17.5px; font-weight: bold; font-style: normal">
                User Type</td>
            <td class="style17">
                <asp:DropDownList ID="ddlUserSel" runat="server" Height="25px" Width="260px" CssClass="drp">
                    <asp:ListItem Value="0">Admin</asp:ListItem>
                    <asp:ListItem Value="1">Customer</asp:ListItem>
                </asp:DropDownList>
            </td>
        </tr>
        <tr>
            <td class="style16" style="border-style: none; font-family: 'Times New Roman', Times, serif;
                font-size: 17.5px; font-weight: bold; font-style: normal">
                Login
            </td>
            <td class="style17">
                <asp:TextBox ID="txtUserName" runat="server" Width="250px" CssClass="Textbox1" MaxLength="15"></asp:TextBox>
                <asp:RequiredFieldValidator ID="reqUserName" runat="server" ErrorMessage="*" ForeColor="Red"
                    ControlToValidate="txtUserName" Font-Size="Large"></asp:RequiredFieldValidator>
            </td>
        </tr>
        <tr>
            <td class="style16" style="font-family: 'Times New Roman', Times, serif; font-size: 17.5px;
                font-weight: bold; font-style: normal">
                Password
            </td>
            <td class="style17">
                <asp:TextBox ID="txtPassword" runat="server" TextMode="Password" Width="250px" CssClass="Textbox1" MaxLength="15"></asp:TextBox>
                 <asp:RequiredFieldValidator ID="reqPassword" runat="server" ErrorMessage="*" ForeColor="Red"
                    ControlToValidate="txtPassword" Font-Size="Large"></asp:RequiredFieldValidator>
            </td>
        </tr>
        <tr>
            <td colspan="2" align="center">
                <asp:Label ID="lblDisp" runat="server" ForeColor="Red"></asp:Label>
            </td>
        </tr>
        <tr>
            <td colspan="2" align="center">
                &nbsp;<asp:Button ID="btnSubmit" runat="server" CssClass="btn1" Text="Submit" 
                    OnClick="btnSubmit_Click" Width="80px"/>
                &nbsp;&nbsp;
                <asp:Button ID="btnCancel" runat="server" CssClass="btn1" Text="Cancel" 
                    OnClick="btnCancel_Click" Width="80px"/>
            </td>
        </tr>
    </table>
</div>

Now I’m having the following issues:

1. Irrespective of the user type, the page always gets redirected to Lic_Gen.aspx.
2. Even if I enter the wrong password, the page still gets redirected to Lic_Gen.aspx.
3. The page should also check whether the userType entered i.e. Admin or Customer should be valid with that particular Login ID and Password. But I can’t get to that either.

I know these issues are arriving because of the fact I’ve explicitly defined UserType value as 0.

When I tried converting it with the following code:
int userType = Convert.ToInt32(strnew); it doesn’t work.

So any guidelines on how to improve my basic page?

Answer 1

Based on provided code, possible problems are :

1. No data returned in sdrDatanew, hence the userType always remains 0
2. Data from DB returned under sdrDatanew["User_Type"] is always 0 (string), hence the userType always remains 0

Please use above points to debug further and I see no issues in code.

CAUTION : Your code is vulnerable to SQL Injection attack. Please read details @ http://en.wikipedia.org/wiki/SQL_injection. If you are planning to publish this web site somewhere, you will be in trouble for sure.