Member Avatar for Maha Sh.

Hi All,

I am using Visual Studio 2010 and for my database I'm using SQL

I am trying to make a multi user login and valdate the input with my datatable

the problem is that i made a login page but it's just check the username and the password but not the access type

I don't know how to include the access type in my code...!!

Plz help

Protected Sub Button1_Click(ByVal sender As Object, ByVal e As EventArgs) Handles Button1.Click
Dim connection As New SqlClient.SqlConnection
Dim command As New SqlClient.SqlCommand
Dim adaptor As New SqlClient.SqlDataAdapter
Dim dataset As New DataSet

    connection.ConnectionString = ("Data Source=.\SQLEXPRESS;AttachDbFilename='C:\Users\sony\Documents\Visual Studio 2010\Projects\SADA\SADA\App_Data\SADA.mdf';Integrated Security=True;Connect Timeout=30;User Instance=True")
    command.CommandText = "SELECT * FROM [User] WHERE (UserName='" + TextBox1.Text + "')AND (PW='" + TextBox2.Text + "');"
    connection.Open()

    command.Connection = connection
    adaptor.SelectCommand = command
    adaptor.Fill(dataset, "0")
    Dim count = dataset.Tables(0).Rows.Count

    If count > 0 Then
        Response.Redirect("Admin.aspx")

    Else
        MsgBox("Error in the input")


    End If

End Sub
  • 2 Contributors
  • 2 Replies
  • 120 Views
  • 22 Hours Discussion Span
  • Latest Post Latest Post by Maha Sh.

Dani AI

Generated

— the current flow validates credentials but does not use the stored access/role to decide where to send the user, and it builds SQL with string concatenation. As . noted, that is vulnerable and hard to extend. A clearer, safer pattern is: query by username (parameterized), read the stored hash/salt and role, verify the password with a strong KDF, then redirect or set an auth ticket based on the role.

Below is a compact VB.NET example that avoids inline SQL concatenation and reads the role for decision logic:

Dim cs = ConfigurationManager.ConnectionStrings("MyDb").ConnectionString
Using cn As New SqlConnection(cs)
    Using cmd As New SqlCommand("SELECT Role, PasswordHash, Salt FROM Users WHERE Username = @u", cn)
        cmd.Parameters.AddWithValue("@u", txtUser.Text)
        cn.Open()
        Using rdr = cmd.ExecuteReader()
            If rdr.Read() Then
                Dim role = rdr.GetString(0)
                Dim hash = rdr.GetString(1)
                Dim salt = rdr.GetString(2)
                If VerifyPassword(txtPass.Text, hash, salt) Then
                    If role = "Admin" Then
                        Response.Redirect("Admin.aspx")
                    Else
                        Response.Redirect("Default.aspx")
                    End If
                End If
            End If
        End Using
    End Using
End Using

Use a secure verification function (PBKDF2 shown here). Store hash and salt as Base64 and choose a high iteration count:

Function VerifyPassword(password As String, storedHash As String, storedSalt As String) As Boolean
    Dim saltBytes = Convert.FromBase64String(storedSalt)
    Using pbkdf2 As New System.Security.Cryptography.Rfc2898DeriveBytes(password, saltBytes, 20000)
        Dim computed = pbkdf2.GetBytes(32)
        Return Convert.ToBase64String(computed) = storedHash
    End Using
End Function

Additional notes: never store plaintext passwords; prefer framework solutions (ASP.NET Membership / ASP.NET Identity) for production so hashing, lockout and role plumbing are handled correctly; use FormsAuthentication or a proper auth middleware to create the auth ticket and enforce role-based access in Web.config (or via attributes) rather than relying solely on redirect logic.

Recommended Answers

All 2 Replies

Member Avatar for JorgeM

Unless you really want to write up all of the code regarding security (login pages, reset passwords, user management, etc..), you may want to use the built-in login controls. I would recommend that you visit Microsoft's site for help on asp.net. They have a section that covers user security: http://www.asp.net/web-forms/overview/security

The only other thing I would recommend is that rather than building the commandText in the manner shown above, which is very common, you should use parameters instead. The code listed above is vulnerable to SQL injection attacks. Think about where a malicious user rather than supplying a user name, the malicious user inputs a single quote, then adds SQL commands to drop your table, or display information about the first user in your table, which may be an administrator.

You may want to research this some more since it appears you are starting this project.

Member Avatar for Maha Sh.

Thanks ITG-JM for your advice.

I'll check Microsoft's site :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.