form-based authentication using a database

waru · May 28th, 2004, 09:59 PM

I want to check if the user name and password the user provides to textboxes is the same with those in a database and if so show him his details but i can't make it work. Here is the code:
---------------------------------------------------------------------
THE CS FILE

using System;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Collections;
using System.Data;
using System.Data.OleDb;

public class myUserControl2: UserControl{
    public TextBox txtUID;
    public TextBox txtPWD;
    public Label lbl;

  public void myClick(object sender, EventArgs e){
      string strCon, strSQL;
      strCon = "Provider=Microsoft.Jet.OLEDB.4.0;";
      strCon += "Data Source=" + Server.MapPath("userInfo.mdb");
      strSQL = "SELECT userID, userName, userPassword,userInfo FROM usersTable";
try{
   OleDbConnection objCon = new OleDbConnection(strCon);
   objCon.Open();
   OleDbCommand objCmd = new OleDbCommand(strSQL,objCon);
    OleDbDataReader objReader = objCmd.ExecuteReader (CommandBehavior.CloseConnection);
while(objReader.Read()){
   if(objReader["userName"].ToString()== txtUID.Text && objReader ["userPassword"].ToString()==txtPWD.Text){
lbl.Text = "success!" + "<br>" + objReader["userPassword"].ToString();
}
else{
  lbl.Text = "failure" + "<br>" + objReader["userName"] + "<br>" +
   objReader["userPassword"].ToString() +
  "<br>" + objReader["userInfo"].ToString();
}
}
objReader.Close();
objCon.Close();
}
catch(OleDbException objError){
if(objError.Message.Substring(0,19)=="Could not find file"){
lbl.Text = objError.Message + objError.Source;
}
else{
   lbl.Text = objError.Message + objError.Source;
}
}

}
}
---------------------------------------------------------------------THE ASCX FILE

<%@ Control Inherits="myUserControl2" Src="ch15_5_UserControl.cs"%>

<html>
<head>
<title></title>
</head>
<body>
<form runat="server">
  User name:<asp:TextBox id="txtUID" runat="server"/><br/>
  Password:<asp:TextBox id="txtPWD" runat="server" TextMode="password"/></br>
<asp:button id="btn" runat="server" onClick="myClick" Text="Submit"/><br/>
<asp:RequiredFieldValidator id="rfv" Runat="server" ControlToValidate="txtUID" ErrorMessage="Enter user name"/>
<asp:RequiredFieldValidator id="rfv2" Runat="server" ControlToValidate="txtPWD" ErrorMessage="Enter password"/>
</form>
<asp:label id="lbl" runat="server"/>
</body>
</html>
---------------------------------------------------------------------THE ASPX FILE

<%@ Page Language="C#" Debug="true"%>
<%@ Register TagPrefix="myUC" TagName="myUserControl2" Src="ch15_5_UserControl.ascx"%>
<html>
<head>
<title></title>
</head>
<body>
    <myUC:myUserControl2 id="myU" runat="server"/>

</body>
</html>

bmains · May 28th, 2004, 10:22 PM

Hello,

Just to verify, you are setting up the click event; I didn't see an event handler declaration; did I miss something? Also, if you think your problem is on the database side, what you can do is change your query to:

strSQL = "SELECT userID, userName, userPassword,userInfo FROM usersTable where userID = '" + txtUID.Text + '" and userPassword = '" + txtPWD.Text + "'";

If there are rows present, then the account credentials are correct.

Brian

waru · May 28th, 2004, 10:37 PM

Hello. Thanks for the help but it still doesn't work. About the onClick event i'm setting it:

public void myClick(object sender, EventArgs e){
  if(txtUID.Text=="[email protected]" && txtPWD.Text=="treyxxxx"){
    lbl.Text = "Welcome waru";
  }
  else if((txtUID.Text=="[email protected]" && txtPWD.Text=="vgsxxxxx") ||
(txtUID.Text=="[email protected]" && txtPWD.Text=="nikifxxx")){
lbl.Text = "Welcome";
}
else{
  lbl.Text="Wrong user name or password";

}
}
I'm sure there is no problem with the database. I noticed(using a label) that the DataReader keeps one record(one user name, password etc) whitch doesn't change when i click the button. Another strange thing is that once in a while it works!