Member Avatar for jaimin4829

Hi i am developing a website to downlod softwares online.From general page of softwares user is allowed to download software after login or register.after login it must be go to user panel's main download page with taking id of software on which a person has clicked..i code below at login page. "sid" is id of software and "tid" is template id..

 Protected Sub btnlogin_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles btnlogin.Click
        adp = New SqlDataAdapter("select * from User_details where Email_id='" & TextBox1.Text.ToString() & "' and Password='" & TextBox2.Text.ToString() & "' ", constr)
        dset = New DataSet
        dset.Clear()
        adp.Fill(dset)
        Dim sstr As String
        Dim tstr As String
        Dim type As String = "1"



        Try
            sstr = Request.QueryString.Item("sid").ToString()
            type = "soft"

        Catch ex As Exception

        End Try

        Try
            tstr = Request.QueryString.Item("tid").ToString()
            type = "temp"
        Catch ex As Exception

        End Try


        If dset.Tables(0).Rows.Count > 0 Then
            Session.Add("user_loged", "true")
            Session.Add("user_name", dset.Tables(0).Rows(0).Item(1).ToString)
            Session.Add("user_id", dset.Tables(0).Rows(0).Item(0).ToString)
            Try


                If Request.QueryString.Item("q").ToString() <> 1 Then

                    Response.Redirect("AdminPanel/Profile.aspx")
                Else
                    If type = "soft" Then
                        Dim id As Integer
                        id = Integer.Parse(Request.QueryString.Item("sid").ToString())
                        Response.Redirect("Downloadmain.aspx?sid=" & Integer.Parse(Request.QueryString.Item("sid").ToString()) & "")
                    ElseIf type = "temp" Then
                        Response.Redirect("Templatemain.aspx?sid=" & Integer.Parse(Request.QueryString.Item("tid").ToString()) & "")
                    Else
                        Response.Redirect("AdminPanel/Profile.aspx")

                    End If
                End If

            Catch ex As Exception

            End Try

        Else
            Session.Add("user_loged", "false")
            ' MsgBox("Invalid UserName or Password")
            'Response.Redirect("Login.aspx?error=Invalid password or user name")
            Label1.Visible = True
            Label1.Text = "Invalid UserName or Password"
            Label1.ForeColor = Drawing.Color.Red

        End If
    End Sub
  • 2 Contributors
  • 1 Reply
  • 208 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by hometownnerd

Dani AI

Generated

A few focused points to make the post-login redirect reliable and safe.

Your goal (return the user to the download/template page they clicked) is best solved by saving the desired endpoint before forcing the login, then restoring it after authentication. Right now several Try/Catch blocks silently swallow missing query values and that makes the flow brittle. Also check the small mismatch where you send tid but later build a URL parameter named sid for the template page — keep the parameter names consistent.

Suggested workflow (robust and safe)

  • When the download button discovers the user is not authenticated, store the full target (path + query) as a single ReturnUrl value (URL-encoded) or in Session, then redirect to the login page.
  • After a successful login, check Request.QueryString("ReturnUrl") (or the Session value). Validate it (ensure it’s an internal path, starts with “/”, and does not contain an absolute host) before redirecting to avoid open-redirect attacks.
  • Only parse query values to integers when you need numeric math; otherwise use the raw string for building a redirect. Use Integer.TryParse to avoid exceptions.

Small code patterns to adopt (VB.NET)

' check for a ReturnUrl and validate before redirect
Dim r = Request.QueryString("ReturnUrl")
If Not String.IsNullOrEmpty(r) AndAlso r.StartsWith("/") Then
    Response.Redirect(Server.UrlDecode(r))
Else
    Response.Redirect("~/AdminPanel/Profile.aspx")
End If

Security and robustness reminders

  • Stop concatenating SQL with textbox contents; use parameterized SqlCommand and store passwords as hashes (PBKDF2/Bcrypt) rather than plaintext.
  • Replace string session flags with booleans.
  • Avoid empty Catch blocks — at minimum log exceptions so you can see why a redirect failed during debugging.
  • Use breakpoints or simple logging (dump Request.QueryString) to observe the exact values at runtime; that will quickly reveal why a redirect didn’t include the expected sid/tid.

These changes will make the redirect behavior predictable and will fix the intermittent failures you’re seeing. ’s point about not needlessly converting values is sound — use the raw query value for redirects unless you have to validate it as a number.

Member Avatar for hometownnerd

Not sure what you are looking for exactly, is something going wrong with your code now? I see the redirects, I also see that you are doing some conversion on the querystrings, wouldn't simply Request.QueryString("sid") work? or are you really interested in going through the conversion to integer? I would go with

Response.Redirect("Downloadmain.aspx?sid=" & Request.QueryString("sid"))

That way it does not fail for miscelaneous reasons. Let us know what you are looking for exactly and someone may be able to help a bit.
Have fun,
Larry

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.