0
using System;
using System.Collections;
using System.Configuration;
using System.Data;
using System.Linq;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Xml.Linq;
using System.Data.SqlClient;

public partial class loginApplicant : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {



    }
    protected void btnsubmit_Click(object sender, EventArgs e)
    {   
       // String pageName = Request.QueryString["pageName"].ToString();
       // int advId = int.Parse(Request.QueryString["advId"]);
        String pageName = Request.QueryString["pageName"] ==  null ? null : Request.QueryString["pageName"].ToString();
        int advId = Request.QueryString["advId"] == null ? 0 : int.Parse(Request.QueryString["advId"]);
        String hashedPwd = FormsAuthentication.HashPasswordForStoringInConfigFile(txtboxPassword.Text, "SHA1");
        //Response.Write(hashedPwd);
        String conString = "Data Source=COSANOSTRA;Initial Catalog=Waleed_orsfinal;Integrated Security=True";
        SqlConnection con = new SqlConnection(conString);
        String query = "select email,password from tblUser where email='" + txtboxUserEmail.Text + "' and password= '" + hashedPwd + "' ";
        SqlCommand com = new SqlCommand(query, con);

        try
        {
            con.Open();
            SqlDataReader dr = com.ExecuteReader();

            if (dr.Read() == true && pageName == "page_applyForJob")
            {
                 Session["applicantSession"] = txtboxUserEmail.Text;
                 Response.Redirect("applyForJob.aspx?advId=" + advId);
             }

            else if (dr.Read() == true && pageName== null)
            {

                Session["applicantSession"] = txtboxUserEmail.Text;
                Response.Redirect("~/showAdvertsiement.aspx");
            }
            ***else
            {

                Response.Write("Wrong Combination Of Email and Password");
            }***
        }
        catch (Exception ex)
        {

            Response.Write("error" + ex.Message);


        }
        finally
        {
            con.Close();
        }
    }
}

problem is that only else block is executed when i put pageName equals to null,

but without pagename equal to null, it logins successfully, y ?

chek bold section, it is executed when i place pagename= null, and even no parameter is passing to it

2
Contributors
2
Replies
3
Views
4 Years
Discussion Span
Last Post by HunainHafeez
0

Do you mean you are doing "....mypage.aspx?pageName=null"? This will return a string not null.

Also, including a user generated input (txtboxUserEmail.Text) into your SQL statement is a big security issue. You should sanitize your input and use a paramerized query.

0

actually it was raising exception so i sent false parameter to stop it

Edited by HunainHafeez

This question has already been answered. Start a new discussion instead.
Have something to contribute to this discussion? Please be thoughtful, detailed and courteous, and be sure to adhere to our posting rules.