Login through database
 

hiii,,i m a new member of daniweb and new to programming also..
well i have a simple login page in my website,,
currently i am using standard username and password,,,but i would like to have the username and password checked from a table in the database,,
i am using asp.net 2.0 and sql server 2000....
can any1 help me out how to do it exactly????
thnks in advance....
common guys n gals out thr,,,i really need ur help..help me out

Re: Login through database
 

Create a table to store login and encrypted salt in database, when someone enters a password, use standard encryption algo and see whether the string matches with what is there in database. It is pretty straight forward.

Re: Login through database
 

hi johnny.g,
There are several article's were available , make Googled and you can definately got some solution on it.
I found out two article based on it. Just visit the link.

http://www.daniweb.com/forums/thread6028.html

http://support.microsoft.com/default...;EN-US;q301240

Hope this will help you.
Thanks & Regards
Dilipv

Re: Login through database
 

___________
well my dear,,thnks for ur help,,
i m lookin for a solution,,i have created a table for username and password,
i have also created the sql connection for the same,,
what i want is the code to check the username and password from the table...
hope u understand what i need,,,thnks in advance

Re: Login through database
 

_____________________
hey dude,,thnks for the link,,i wil check the link and let u kno,,,thnks 1ce again
c ya

Re: Login through database
 

Here's one simple example where you can receive, check and redirect user logins.
Change the DB table fields and so on to match your own data base.

<%

PW = Request.Form("pass") ' password from the loginform

UN = Request.Form("user") ' username from the loginform



SQL = "SELECT * FROM <user_table> WHERE username = '"& UN &"' AND passwd ='"& PW &"'"

Set RS = Conn.Execute(SQL)





If Not RS.EOF Then ' If the username and password exists in the database



Session("valid") = True '  Keep the valid value in session for later use

Session("uid") = RS("<userid>") ' Keep the member userid in session for later use



Response.Redirect"some_valid_members_page.asp?uid=" & Session("uid")



Else  'If the username and password NOT exists in the database, send them back to your loginpage



Response.Redirect"some_page_where_you_have_the_login_form.asp 



RS.Close

Conn.Close

Set RS = Nothing

Set Conn = Nothing

End If

%>

Re: Login through database
 

That's pretty much it. The only thing you have to worry about is case sensitivity. This depends on your server settings on which it is set to case-sensitive or case-insensitive. You should pull the password from the database and then check it thoroughly. You don't want someone to use "PassWoRd" and allow them to login with "password", you know what I mean?

Just create a connection and recordset. Then create an SQL query to retrieve the password. Check to see if there are any results (EOF = end of file), then compare the two if there are. If there are not any results, post an error to the user. An example of this was above, and is below:

Dim rs, conn, sql, passwd, uname



passwd = Trim(Request.Form("password"))

uname = Trim(Request.Form("username"))



Set conn = Server.CreateObject("ADODB.Connection")

conn.Provider = "this is your connection string. Look one up at http://connectionstrings.com"



Set rs = Server.CreateObject("ADODB.Recordset")



'Select the password from the database where the supplied username exists.

sql = "SELECT userpassword FROM users WHERE username='" & uname & "'"



'Open the connection called "conn"

conn.Open()



'Open a recordset that retrieves the query with connection "conn"

rs.Open sql, conn



if Not rs.EOF then

  'If you haven't reached the end of the recordset, there must be a record!

  if StrComp(rs("userpassword"), passwd, 0) = 0 then

    'The 0 stands for case-sensitive. 1 is case-insensitive.

    'If this command equals zero, then it passed validation.

    'Give them a session to store that they logged in. This way you can check

    'at a later time if they logged in.

    Session("logged") = "True"

    'Send the user to the good pages!

    response.redirect("loggedin.asp")

  else

    'Failed to login, incorrect password.

    'Try not to let them know if they have the right username.

    'Just tell them it all failed.

    response.write("incorrect username or password.")

  end if

else

  'No records, meaning there are no users with that username.

  response.write("incorrect username or password.")

end if



rs.Close()

set rs = nothing



conn.Close()

set conn = nothing

'If you do not close the connection, they will continuously rack up, which will slow down, if not halt your program/website. Always close. Disposing of the variable (setting it to nothing) frees up space for the next user. Not required, but definitely good techniques.

Re: Login through database
 

.... when user finally is logged in to the good page, you can put a code like this at top of that page.

When session dies, which it does after a while if the user is inactiv or by closing down the browser. The session lifetime can also be set. However if the user "session" is no longer valid then user cannot view the page. That is why you keep this session value in the first place.

If Session("valid") <> True Then
Response.Redirect"some_page_where_you_have_the_login_form.asp"
End If


Just for fun - check your session settings

<html>
<body>

<p>
The timeout for this session is
<%
Response.Write(Session.Timeout)
%>
minutes.
</p>

</body>
</html>

Re: Login through database
 

_____________________________
thnks,, i m going thr the code given by u,,will let u kno soon
for the session part,,,i hav given time out in the web.config file using authentication and authorization,,is tht ok??,,thnks

Re: Login through database
 

That's not asp, isn't that asp.net? different language, completely.