How to compare Login Information with databse and then log in

Question

jaijinendra 0 Newbie Poster

16 Years Ago

Hello All,

I have created simple login form through VS 2008 using C#. There are 5 different aspx pages in my web application.

1)Default.aspx: It contains only a hyperlink to direct the user to login.aspx page.
2)Login.aspx: This page has texbox for Username and Password, sign in button, textbox for displaying error and hyperlink (Create an Account) if the user does not created an account yet.

Here is Login.aspx code:

<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="login.aspx.cs" Inherits="WebApp01.login" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title></title>
</head>
<body>
    <form id="form1" runat="server">
    <div>
        <h3>
            <font face="Verdana">Logon Page</font>
        </h3>
        <table>
            <tr>
                <td>
                    Username:
                </td>
                <td>
                    <input id="txtUserName" type="text" runat="server" />
                </td>
                <td>
                    <asp:RequiredFieldValidator ControlToValidate="txtUserName" Display="Static" ErrorMessage="*"
                        runat="server" ID="vUserName" />
                </td>
            </tr>
            <tr>
                <td>
                    Password:
                </td>
                <td>
                    <input id="txtUserPass" type="password" runat="server" />
                </td>
                <td>
                    <asp:RequiredFieldValidator ControlToValidate="txtUserPass" Display="Static" ErrorMessage="*"
                        runat="server" ID="vUserPass" />
                </td>
            </tr>
            <tr>
                <td>
                    Persistent Cookie:
                </td>
                <td>
                    <asp:CheckBox ID="chkPersistCookie" runat="server" AutoPostBack="false" />
                </td>
                <td>
                </td>
            </tr>
        </table>
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
        <asp:Button ID="btnSignIn" runat="server" OnClick="btnSignIn_Click" Text="Sign In1" />
        <br />
        <br />
        <asp:TextBox ID="txtResult" runat="server" Width="268px"></asp:TextBox>
        <br />
        <br />
        Do not have an Account?<h3>
            <asp:HyperLink ID="HyperLink1" runat="server" NavigateUrl="~/signupwizard.aspx">Create an Account</asp:HyperLink>
        </h3>
        <p>
        </p>
        <asp:Label ID="lblMsg" ForeColor="red" Font-Name="Verdana" Font-Size="10" runat="server" />
    </div>
    </form>
</body>
</html>

3)SignUpWizard.aspx: When the users click on hyperlink (Create an Account) on login.aspx, they are directed to SignUpWizard.aspx. This page has simple form and collect the information from user and save into database. I have successfully done the insertion of user information into my databse using C#. If the insertion is successful, application will direct the user to Confirm.aspx otherwise it will direct user to Problem.aspx. I have not included aspx file for this page but here is code behind file.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Configuration;


namespace WebApp01
{
    public partial class signupwizard : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {
            txtFirstName.Focus();
        }

        protected void btnSubmit_Click(object sender, EventArgs e)
        {
            SqlDataSource tblUserInfo1DateSource = new SqlDataSource();
            tblUserInfo1DateSource.ConnectionString = ConfigurationManager.ConnectionStrings["MyDBConnectionString"].ToString();

            tblUserInfo1DateSource.InsertCommandType = SqlDataSourceCommandType.Text;
            tblUserInfo1DateSource.InsertCommand = "INSERT tblUSerInfo1 (uiFirstName, uiLastName, uiUsername, uiPassword, uiCountry, uiDateOfBirth) VALUES (@uiFirstName, @uiLastName, @uiUSername, @uiPassword, @uiCountry, @uiDateOfBirth)";

            tblUserInfo1DateSource.InsertParameters.Add("uiFirstName", txtFirstName.Text);
            tblUserInfo1DateSource.InsertParameters.Add("uiLastName", txtLastName.Text);
            tblUserInfo1DateSource.InsertParameters.Add("uiUsername", txtUsername.Text);
            tblUserInfo1DateSource.InsertParameters.Add("uiPassword", txtChoosePassword.Text);
            tblUserInfo1DateSource.InsertParameters.Add("uiCountry", ddlCountry.Text);
            tblUserInfo1DateSource.InsertParameters.Add("uiDateOfBirth", txtDOB.Text);

            int rowsaffected = 0;

            try
            {
                rowsaffected = tblUserInfo1DateSource.Insert();
            }
            catch
            {
                Response.Redirect("problem.aspx");
            }
            finally
            {
                tblUserInfo1DateSource = null;
            }

            if (rowsaffected != 1)
            {
                Response.Redirect("problem.aspx");
            }
            else
            {
                Response.Redirect("confirm.aspx");
            }
        }
    }
}

Now, I want to do following with my application.

If the user already has an account, he can put his username and password and click on the sign in button. If the username is existed in databse, application should compare the user input with database and if both are matched then the application should redirect the user to "welcome.aspx". If username does not exist it should show that Username does not exist. Does anyone have any idea?

.net:c# database-design

4 Contributors
3 Replies
123 Views
2 Days Discussion Span
Latest Post 16 Years Ago Latest Post by ashishkj1989

Dani AI

Generated 9 Months Ago

Quick summary and practical path forward for : the login flow should (1) look up the user record with a parameterized query, (2) verify the supplied password against a stored salted hash, then (3) create an authenticated session or cookie and redirect to welcome.aspx. is right to check the DB; avoid string concatenation (SQL injection). ’s reader-based approach works conceptually but wrap connections/readers in using and compare hashes securely. ’s pointer to learning resources is useful — below are concise, actionable steps and sample code.

Example: read the stored hash+salt and verify (illustrative)

bool ValidateUser(string user, string password)
{
    using (var conn = new SqlConnection(connString))
    using (var cmd = new SqlCommand("SELECT PasswordHash, PasswordSalt FROM tblUser WHERE uiUsername = @u", conn))
    {
        cmd.Parameters.AddWithValue("@u", user);
        conn.Open();
        using (var rdr = cmd.ExecuteReader())
        {
            if (!rdr.Read()) return false; // no such user
            var hash = (byte[])rdr["PasswordHash"];
            var salt = (byte[])rdr["PasswordSalt"];
            return VerifyPassword(password, salt, hash);
        }
    }
}

Hashing notes and signup flow: when creating accounts, generate a random salt, derive a hash via PBKDF2 (Rfc2898DeriveBytes) and store both (use VARBINARY columns). Example pattern: create 16-byte salt with a secure RNG, derive a 32-byte hash with >=10,000 iterations, then store. On login, derive the hash the same way and compare with a constant-time comparison (avoid ==).

Troubleshooting and links: use using blocks for connections/readers, ensure correct DB types, and prefer a generic error like “Invalid username or password” to avoid revealing account existence. For reference: Rfc2898DeriveBytes (PBKDF2) documentation (Rfc2898DeriveBytes docs), parameterized ADO.NET (SqlCommand.Parameters) (SqlCommand.Parameters docs), ASP.NET auth cookie (FormsAuthentication.SetAuthCookie) (SetAuthCookie docs), and OWASP guidance on authentication (Authentication Cheat Sheet).

All 3 Replies

dnanetwork 18 Practically a Master Poster

16 Years Ago

visit asp.net site there you'll find video tutorial..

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

jugosoft 25 Junior Poster in Training · Answer 1 · 2010-07-28T18:06:57+00:00

Create a functions that will check if username exists (SELECT * FROM table WHERE USERNAME = '" & username & "'"). If reader.Read then return True else return False. It's same code for checking password (if password = reader("PASSWORD"))..

ashishkj1989 0 Newbie Poster · Answer 2 · 2010-07-29T00:34:42+00:00

protected void Button1_Click(object sender, EventArgs e)
    {
        string connectString = "Data Source=VOSTRO\\SQLEXPRESS;Initial Catalog=master;Integrated Security=True";
        SqlConnection con = new SqlConnection(connectString);
        con.Open();
        string lecd = (string)(Session["v"]);
        //selecting data from database   
        string sql = "select * from employees WHERE e_code=" + lecd;
        SqlCommand cmd = new SqlCommand(sql, con);
        SqlDataReader reader = cmd.ExecuteReader();
        while (reader.Read())
        {
            string password = reader["password"].ToString();



            if (TextBox1.Text == password)
            {

                if (TextBox2.Text == TextBox3.Text)
                {

                    SqlConnection con1 = new SqlConnection(connectString);
                    con1.Open();
                    string sql1 = "UPDATE employees SET password =@password WHERE e_code=(@e_code)";
                    SqlCommand cmd1 = new SqlCommand(sql1, con1);
                    cmd1.Parameters.Add("e_code", lecd);
                    cmd1.Parameters.Add("password", TextBox3.Text);
                    cmd1.ExecuteNonQuery();
                    con1.Close();
                    Label6.Visible = true;
                    Label6.Text = "done";

                }
                else
                {
                    Label6.Visible = true;
                    Label6.Text = "password mismatch";


                }

            }
            else
            {
                Label6.Visible = true;
                Label6.Text = "Enter correct password";
            }
        }
        con.Close();
      

    }

How to compare Login Information with databse and then log in

Dani AI

Recommended Answers Collapse Answers

All 3 Replies

Recommended Answers