Login through database

[johnny.g]

hiii,,i m a new member of daniweb and new to programming also..
well i have a simple login page in my website,,
currently i am using standard username and password,,,but i would like to have the username and password checked from a table in the database,,
i am using asp.net 2.0 and sql server 2000....
can any1 help me out how to do it exactly????
thnks in advance....
common guys n gals out thr,,,i really need ur help..help me out

[ithelp]

Create a table to store login and encrypted salt in database, when someone enters a password, use standard encryption algo and see whether the string matches with what is there in database. It is pretty straight forward.

[dilipv]

hi johnny.g,
There are several article's were available , make Googled and you can definately got some solution on it.
I found out two article based on it. Just visit the link.

http://www.daniweb.com/forums/thread6028.html

http://support.microsoft.com/default.aspx?scid=KB;EN-US;q301240&ID=KB;EN-US;q301240

Hope this will help you.
Thanks & Regards
Dilipv

[johnny.g]

Create a table to store login and encrypted salt in database, when someone enters a password, use standard encryption algo and see whether the string matches with what is there in database. It is pretty straight forward.

___________
well my dear,,thnks for ur help,,
i m lookin for a solution,,i have created a table for username and password,
i have also created the sql connection for the same,,
what i want is the code to check the username and password from the table...
hope u understand what i need,,,thnks in advance

[johnny.g]

hi johnny.g,
There are several article's were available , make Googled and you can definately got some solution on it.
I found out two article based on it. Just visit the link.

http://www.daniweb.com/forums/thread6028.html

http://support.microsoft.com/default.aspx?scid=KB;EN-US;q301240&ID=KB;EN-US;q301240

Hope this will help you.
Thanks & Regards
Dilipv

_____________________
hey dude,,thnks for the link,,i wil check the link and let u kno,,,thnks 1ce again
c ya

[TobbeK]

Here's one simple example where you can receive, check and redirect user logins.
Change the DB table fields and so on to match your own data base.

<%
PW = Request.Form("pass") ' password from the loginform
UN = Request.Form("user") ' username from the loginform

SQL = "SELECT * FROM <user_table> WHERE username = '"& UN &"' AND passwd ='"& PW &"'"
Set RS = Conn.Execute(SQL)


If Not RS.EOF Then ' If the username and password exists in the database

Session("valid") = True '  Keep the valid value in session for later use
Session("uid") = RS("<userid>") ' Keep the member userid in session for later use

Response.Redirect"some_valid_members_page.asp?uid=" & Session("uid")

Else  'If the username and password NOT exists in the database, send them back to your loginpage

Response.Redirect"some_page_where_you_have_the_login_form.asp 

RS.Close
Conn.Close
Set RS = Nothing
Set Conn = Nothing
End If
%>

[SheSaidImaPregy]

That's pretty much it. The only thing you have to worry about is case sensitivity. This depends on your server settings on which it is set to case-sensitive or case-insensitive. You should pull the password from the database and then check it thoroughly. You don't want someone to use "PassWoRd" and allow them to login with "password", you know what I mean?

Just create a connection and recordset. Then create an SQL query to retrieve the password. Check to see if there are any results (EOF = end of file), then compare the two if there are. If there are not any results, post an error to the user. An example of this was above, and is below:

Dim rs, conn, sql, passwd, uname

passwd = Trim(Request.Form("password"))
uname = Trim(Request.Form("username"))

Set conn = Server.CreateObject("ADODB.Connection")
conn.Provider = "this is your connection string. Look one up at http://connectionstrings.com"

Set rs = Server.CreateObject("ADODB.Recordset")

'Select the password from the database where the supplied username exists.
sql = "SELECT userpassword FROM users WHERE username='" & uname & "'"

'Open the connection called "conn"
conn.Open()

'Open a recordset that retrieves the query with connection "conn"
rs.Open sql, conn

if Not rs.EOF then
  'If you haven't reached the end of the recordset, there must be a record!
  if StrComp(rs("userpassword"), passwd, 0) = 0 then
    'The 0 stands for case-sensitive. 1 is case-insensitive.
    'If this command equals zero, then it passed validation.
    'Give them a session to store that they logged in. This way you can check
    'at a later time if they logged in.
    Session("logged") = "True"
    'Send the user to the good pages!
    response.redirect("loggedin.asp")
  else
    'Failed to login, incorrect password.
    'Try not to let them know if they have the right username.
    'Just tell them it all failed.
    response.write("incorrect username or password.")
  end if
else
  'No records, meaning there are no users with that username.
  response.write("incorrect username or password.")
end if

rs.Close()
set rs = nothing

conn.Close()
set conn = nothing
'If you do not close the connection, they will continuously rack up, which will slow down, if not halt your program/website. Always close. Disposing of the variable (setting it to nothing) frees up space for the next user. Not required, but definitely good techniques.

[TobbeK]

.... when user finally is logged in to the good page, you can put a code like this at top of that page.

When session dies, which it does after a while if the user is inactiv or by closing down the browser. The session lifetime can also be set. However if the user "session" is no longer valid then user cannot view the page. That is why you keep this session value in the first place.

If Session("valid") <> True Then
Response.Redirect"some_page_where_you_have_the_login_form.asp"
End If

Just for fun - check your session settings

<html>
<body>

<p>
The timeout for this session is
<%
Response.Write(Session.Timeout)
%>
minutes.
</p>

</body>
</html>

[johnny.g]

.... when user finally is logged in to the good page, you can put a code like this at top of that page.

When session dies, which it does after a while if the user is inactiv or by closing down the browser. The session lifetime can also be set. However if the user "session" is no longer valid then user cannot view the page. That is why you keep this session value in the first place.

If Session("valid") <> True Then
Response.Redirect"some_page_where_you_have_the_login_form.asp"
End If

Just for fun - check your session settings

<html>
<body>

<p>
The timeout for this session is
<%
Response.Write(Session.Timeout)
%>
minutes.
</p>

</body>
</html>

_____________________________
thnks,, i m going thr the code given by u,,will let u kno soon
for the session part,,,i hav given time out in the web.config file using authentication and authorization,,is tht ok??,,thnks

[SheSaidImaPregy]

That's not asp, isn't that asp.net? different language, completely.

[TobbeK]

Nope the web.config file isn't used by ASP what I know.

A session time limit can be set. Default is 20 minutes, the example below is set to 5 minutes.

<%
Session.Timeout=5
%>

[johnny.g]

i think thrs sum confusion...
i have used web.config file for authentication and authorization,,i m using asp.net 2003
sorry for the confusion....

[SheSaidImaPregy]

Yes you are in the wrong forum. Head over to ASP.NET

Then do a search for "Login Membership" and you'll find what you need to. It's been discussed many times.

[johnny.g]

sorry for the confusion and wasting ur time,,,

[nukewarm]

ASP.Net does this right out of the box doesn't it? <asp:Login>...</asp:login>

[SheSaidImaPregy]

yes and no. You have to setup the membership and then yes it does. Requires some customization, but then again.. what doesn't?