Member Avatar for ppstyle 
<asp:SqlDataSource ID="SqlDataSource1" runat="server" 
                    ConnectionString="<%$ ConnectionStrings:PadmaSMSConnectionString %>" 
                    SelectCommand="SELECT [EmailID], [Password],[CnPassword] FROM [Registration]  WHERE [EmailID] = @EmailID" 
                    UpdateCommand="UPDATE [Registration] SET [Password] = @password WHERE [EmailID] = @EmailID">
                    <SelectParameters>
                        <asp:SessionParameter Name="EmailID" SessionField="User" />
                    </SelectParameters>
                    <UpdateParameters>
                        <asp:ControlParameter ControlID="txtnewpass" Name="password" 
                            PropertyName="Text" Type="String" />
                        <asp:Parameter Name="EmailID" />
                    </UpdateParameters>
                </asp:SqlDataSource>



   protected void BtnChangePass_Click(object sender, EventArgs e)
    {
        try
        {
            con = new SqlConnection(ConfigurationManager.ConnectionStrings["PadmaSMSConnectionString"].ConnectionString);
            com = new SqlCommand("select * from Registration where EmailID=@id", con);
            com.Parameters.AddWithValue("@id", Session["User"].ToString());

            con.Open();
            dataread = com.ExecuteReader();
            dataread.Read();
            if (dataread.GetString(6) == this.Txtoldpass.Text)
            {
                this.SqlDataSource1.Update();
                this.Label1.Text = "Your Password has been changed!";

            }
            else
            {

                this.Label1.Text = "Please Enter Correct Old Password";

            }

            con.Close();
        }
        catch (Exception ex)
        {
            Label1.Text = ex.Message;
        }
    }

I need help, please tell me the problem of this code. Thank u

  • 3 Contributors
  • 4 Replies
  • 222 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by hericles

Dani AI

Generated

A few concrete reasons the old-password check is always failing in 's snippet, and practical fixes tied to the thread:

  • The reader isn’t validated before use. Calling dataread.Read() without checking its return or HasRows can leave the reader positioned incorrectly or throw; always check the boolean result before accessing fields.
  • Using a hard-coded column index (GetString(6)) is fragile — column order changes or extra columns break the index. Use the column name (dataread["Password"]) or GetOrdinal("Password").
  • Session value or parameter wiring may be missing. The SqlDataSource’s UpdateParameters includes an EmailID parameter with no source, so Update() runs with an empty @EmailID. Either supply the session value to the UpdateParameters or set it in code before calling Update().
  • Comparison differences (extra whitespace, casing, or hashing) will make equals fail. Trim strings and be aware if the DB stores hashed passwords.

A more reliable pattern is to do the verification+update in one atomic step and check rows affected (this also follows ’s suggestion to update directly). Example approach:

using (var conn = new SqlConnection(connString))
using (var cmd = conn.CreateCommand())
{
    conn.Open();
    cmd.CommandText = "UPDATE Registration SET PasswordHash = @new WHERE EmailID = @email AND PasswordHash = @old";
    cmd.Parameters.Add("@email", SqlDbType.NVarChar, 256).Value = Session["User"]?.ToString() ?? "";
    cmd.Parameters.Add("@old", SqlDbType.NVarChar, 256).Value = oldTrimmed;
    cmd.Parameters.Add("@new", SqlDbType.NVarChar, 256).Value = newTrimmed;
    int rows = cmd.ExecuteNonQuery();
    // rows == 1 means success; 0 means old password mismatch or no such user
}

Important security and cleanup notes: never store plain text passwords — use a salted hash (PBKDF2/Argon2/BCrypt) and compare hashes. Use using blocks to ensure connections/readers are closed. Avoid AddWithValue for production code and validate Session["User"] before use. For quick debugging, set a breakpoint and inspect the exact DB value returned (or temporarily log it) to confirm which string is being compared.

Recommended Answers

All 4 Replies

Member Avatar for hericles

First up, you haven't explained what the problem you are having is (that always helps for future reference). But in your BtnChangePass method you are only selecting from the database and then saying the password has been changed. Where are you doing the actual update of the database?

Member Avatar for ppstyle

First up, you haven't explained what the problem you are having is (that always helps for future reference). But in your BtnChangePass method you are only selecting from the database and then saying the password has been changed. Where are you doing the actual update of the database?

The problem is that the code which I have posted does not work. The else part is getting executed each time. I am very new to programming itself so I need your guidance and help. Instead of selecting the data from database can i run update query directly?

Member Avatar for Michael27

Nope error

Edited by Michael27 because: error
Member Avatar for hericles

Say, for example, that you let your user reset their passwords directly on your site (no emails get sent out or anything like that). Then, assuming your user is already logged in, you need two things - their email address or user ID (whatever makes them unique in your database) and the new password.
Then you can use an update statement directly.

UPDATE table_name SET password = new_password WHERE user_id = @user_id

The @user_id being a passed in parameter. And that will reset their password is the simplest way possible.

commented: Thank you, it worked! +0
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.