Member Avatar for david.godistei
david.godistei 0 Newbie Poster

I am a beginner in C# database developing. I am developing a payroll application with four (4) user roles (i.e. Admin, Accountant, HR and ReadOnly).

There is a Dashboard that displays four buttons that link their respective access pages. Though when logged in based on the user's role, he is directed to the Dashboard successfully. Now, what am expecting are that when the Admin logs in, all buttons on the dashboard should be active. But whenever any of the other users logs in, all other buttons should be disabled, except his.

Below is the code I used; please can someone modify it for me to achieve my expectation?

    private void loginButton_Click(object sender, EventArgs e)

    {
        SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["con"].ConnectionString);
        SqlCommand command = new SqlCommand();
        con.Open();

        string userText = userTextBox.Text;
        string passText = pwdTextBox.Text;

        SqlCommand cmd = new SqlCommand("select role from UsersLogin where UserName='" + userTextBox.Text + "'and Password='" + pwdTextBox.Text + "'", con);
        SqlDataAdapter da = new SqlDataAdapter(cmd);
        DataTable dt = new DataTable();
        da.Fill(dt);
        if (dt.Rows.Count > 0)
        {
            MessageBox.Show("Welcome to the Dashboard");
            this.Hide();
            Dashboard dashboard = new Dashboard();
            dashboard.Show();  

            cmd = new SqlCommand("SELECT Role from UsersLogin where Username=@Username", con);
            cmd.Parameters.AddWithValue("@Username", userText);
            string role = cmd.ExecuteScalar().ToString();
            MessageBox.Show("Welcome " + role);
            con.Close();
        }       
        else
        {
            MessageBox.Show("Access Denied!!");
            Application.Exit();
        }
        con.Close();
    }
}
  • 1 Contributor
  • 0 Replies
  • 206 Views

Dani AI

Generated

The posted login flow returns the Dashboard before the role lookup finishes and uses string-built SQL, which invites SQL injection and other issues. A cleaner, safer pattern is: authenticate once with a parameterized query (compare a hashed password), retrieve the user's role, then create or open the Dashboard with that role so the UI can enable/disable buttons immediately.

Example (login → get role → pass to Dashboard):

using (var con = new SqlConnection(connString))
using (var cmd = new SqlCommand("SELECT Role, PasswordHash FROM UsersLogin WHERE Username = @u", con))
{
    cmd.Parameters.AddWithValue("@u", username);
    con.Open();
    using (var rdr = cmd.ExecuteReader())
    {
        if (rdr.Read() && VerifyHash(enteredPassword, rdr["PasswordHash"]))
        {
            var role = rdr["Role"].ToString();
            var dash = new Dashboard(role);  // pass role in constructor
            this.Hide();
            dash.Show();
            return;
        }
    }
}
MessageBox.Show("Access denied");

Inside Dashboard, disable everything first and then enable only the permitted button(s). This keeps the logic centralized and easy to audit:

public Dashboard(string role)
{
    InitializeComponent();
    btnAdmin.Enabled = btnAccount.Enabled = btnHR.Enabled = btnReadOnly.Enabled = false;
    switch (role?.Trim().ToLowerInvariant())
    {
        case "admin":
            btnAdmin.Enabled = btnAccount.Enabled = btnHR.Enabled = btnReadOnly.Enabled = true;
            break;
        case "accountant":
            btnAccount.Enabled = true;
            break;
        case "hr":
            btnHR.Enabled = true;
            break;
        case "readonly":
            btnReadOnly.Enabled = true;
            break;
    }
}

Notes and cautions: never store plaintext passwords — use a strong hash (PBKDF2/Argon2/Bcrypt) and verify server-side. Use using-blocks so connections/commands always dispose. Treat UI disabling as convenience only; always check role/permissions on any privileged operation. This approach addresses the immediate button-enable problem while fixing security and lifecycle issues in ’s original flow.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.