Validating users

hcusto · August 9th, 2006, 06:42 AM

I have a form with Username and Password Field.
Also in my Tbl_Users table, I have stored username and password for users in Username, Password columns.

What i want to do now is, when somone enter username and password to go to table (I am using SQLExpres db.) check is there user with provided password and if there is user to create Session "USER" with USER_ID (which I get from Tbl_Users table, column UserID)

I am using C#

Thanks in advance

hcusto · August 9th, 2006, 07:34 AM

I ha solve this one, and here is how.

Code:

        SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["testnaConnectionString"].ConnectionString);
        conn.Open();
        SqlCommand com = new SqlCommand("SELECT UserID, Username, Password FROM tblUsers WHERE Username = '" + TextBox1.Text + "' AND Password = '" + TextBox2.Text + "'", conn);
        DataTable tbl = new DataTable();

        tbl.Load(com.ExecuteReader(CommandBehavior.CloseConnection));
        if (tbl.Rows.Count > 0)
        {
            Session["UserID"] = tbl.Rows[0]["UserID"].ToString();
        }

It's works for me, bu if I have done something wrong pls write.

Imar · August 10th, 2006, 01:43 AM

Yeah, it has something wrong with it... It's pretty open to SQL injection.

Whenever a user enters a name like this:

Name: ' OR 1=1 --
Password:

you end up with this query:

SELECT UserID, Username, Password FROM tblUsers WHERE Username = '' OR 1=1 --' AND Password = '" + TextBox2.Text

which means the user can log in with the first available account which is often the admin becuase it's the account you create first.

You may want to Google a bit for SQL injection and read this whitepaper:
http://www.nextgenss.com/papers/adva..._injection.pdf

Cheers,

Imar

---------------------------------------
Imar Spaanjaars
Everyone is unique, except for me.
Author of ASP.NET 2.0 Instant Results and Beginning Dreamweaver MX / MX 2004
Want to be my colleague? Then check out this post.

hcusto · August 10th, 2006, 03:25 AM

Thnx Imar

I will read it.