Member Avatar for Mia_5

I need a help about this i have a log in form design

Username
Password

And my database table

Username
Password
Usertype

I want that if admin will login admin form will show. While if employee will log in emlpoyee form will show.

How to do that in code. Im using sql server

  • 3 Contributors
  • 2 Replies
  • 436 Views
  • 3 Weeks Discussion Span
  • Latest Post Latest Post by Santanu.Das

Dani AI

Generated

A compact, practical plan that builds on 's security reminder and the thread examples: don't trust plain text passwords, verify credentials on the server, then open the form that matches the user's role.

Suggested DB layout (upgrade from Username/Password/Usertype):
Users(Id INT PK, Username NVARCHAR(100) UNIQUE, PasswordHash VARBINARY(MAX), PasswordSalt VARBINARY(128), UserType NVARCHAR(50))

Below is a minimal VB.NET pattern you can adapt. It:

  • uses a parameterized query,
  • reads the stored salt/hash,
  • re-derives the hash with PBKDF2 (Rfc2898) and compares,
  • returns the UserType so the caller decides which form to show.
Function Authenticate(username As String, password As String) As String
    Dim connStr = My.Settings.MyConnectionString
    Dim sql = "SELECT PasswordHash, PasswordSalt, UserType FROM Users WHERE Username = @u"
    Using cn As New SqlConnection(connStr)
        Using cmd As New SqlCommand(sql, cn)
            cmd.Parameters.Add("@u", SqlDbType.NVarChar, 100).Value = username
            cn.Open()
            Using rdr = cmd.ExecuteReader()
                If Not rdr.Read() Then Return Nothing
                Dim storedHash = DirectCast(rdr("PasswordHash"), Byte())
                Dim storedSalt = DirectCast(rdr("PasswordSalt"), Byte())
                Dim userType = rdr("UserType").ToString()
                Using kdf = New System.Security.Cryptography.Rfc2898DeriveBytes(password, storedSalt, 20000)
                    Dim testHash = kdf.GetBytes(storedHash.Length)
                    If testHash.SequenceEqual(storedHash) Then Return userType
                End Using
            End Using
        End Using
    End Using
    Return Nothing
End Function

' usage
Dim role = Authenticate(txtUser.Text.Trim(), txtPass.Text)
If role Is Nothing Then
    MessageBox.Show("Invalid credentials")
ElseIf role.Equals("admin", StringComparison.OrdinalIgnoreCase) Then
    Dim f As New AdminForm() : f.Show()
Else
    Dim f As New EmployeeForm() : f.Show()
End If

Notes and cautions:

  • Use a vetted password library (BCrypt/Argon2) if you can; PBKDF2 above is acceptable when configured with high iterations.
  • Always use parameterized queries, Using blocks, and keep the connection string secure.
  • Enforce role checks server-side (do not rely on client logic). Log and throttle failed logins.
  • Normalize UserType values (enums or constants) to avoid typos when switching forms.

This directly addresses 's question: authenticate, read Usertype, then show the appropriate form.

Recommended Answers

All 2 Replies

Member Avatar for rproffitt

Let's start with covering a problem I see all too often in new designs. Ready?

NEVER STORE PASSWORDS IN A DATABASE.

So beyond your database schema you show your login with password and then encrypt and salt the user supplie password then compare that to the password in the database which is also encrypted and salted. At no time do you store the plain password. This way you never expose or know the password for reasons in the search above.

Now about your other question. Once you get the login and verify you show the page you want based on usertype.

In psuedocode it's If usertype == "God" then show GodPage eles show MereMotalPage.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.