ASP.NET login validation with database

Question

I have login in my asp page req name/pass and button.

I create the connecttion string to my database and SqlDataSource with the query well here in the SqlDataSource:

<asp:SqlDataSource ID="SqlDataSource1" runat="server" 
     ConnectionString="<%$ ConnectionStrings:CarRentalConnectionString %>" 
     SelectCommand="SELECT * FROM [Customers] WHERE (([UserName] = @UserName) AND ([PassWord] = @PassWord))">
     <SelectParameters>
        <asp:ControlParameter ControlID="uname" Name="UserName" PropertyName="Text" Type="String" />
        <asp:ControlParameter ControlID="pass" Name="PassWord" PropertyName="Text" Type="String" />
    </SelectParameters>
</asp:SqlDataSource>

My problem is I don't know how to active/execute it and how do I get the data that is returned from the query?

I have a feeling am going at this the wrong way (hope am wrong)

Hope one of you can give me a tip or point me in the right direction :)

Thanks in advance

It doesn't look like Classic ASP to me. I think you need to re-tag your question with an ASP.NET tag. — TheCarver
– TheCarver, Commented Jul 28, 2012 at 6:11

Dai · Accepted Answer · 2012-07-28 10:54:18Z

1

Using SqlDataSource is inappropriate as you're not simply retrieving data in a declaritive way. You'll want to define user verification (not validation) logic procedurally.

The usual approach follows. Note that you should hash your passwords rather than storing them in plaintext. Hash salting has been omited for brevity.

public static Boolean Authenticate(String userName, String password) {

    using(SqlConnection c = new SqlConnection("myConnectionString")
    using(SqlCommand cmd = c.CreateCommand()) {
        c.Open();
        cmd.CommandText = "SELECT UserName, PasswordHash, OtherDataEtc FROM Users WHERE UserName = @userName";

        cmd.Parameters.Add("@userName", SqlDbType.Varchar, 50).Value = userEnteredUserName;

        using(SqlDataReader rdr = cmd.ExecuteReader()) {
            if( !rdr.Read() ) return false; // no matching user found

            Byte[] passwordHash = rdr.GetBytes( 1 );
            Byte[] hash = Hash( userEnteredPassword ); // Use at least SHA1
            return Array.Equals( passwordHash, hash );
        }
    }
}

// Usage in ASP.NET:

public override OnPageLoad(Object sender, EventArgs e) {
    if( IsPostBack ) {
        Validate();
        if( IsValid ) {
            Boolean auth = Authenticate( this.userName, this.password ); // member textbox controls
            if( auth ) {
                FormsAuthentication.SetAuthCookie( this.userName, true );
                FormsAuthentication.RedirectFromLoginPage("somewhere", true);
            } else {
                Response.Redirect("loginFailedPage");
            }
        }
    }
}

answered Jul 28, 2012 at 10:54

Dai

158k31 gold badges314 silver badges436 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

user1246950 Over a year ago

thx that helpt and it works ;) i think there is other way of doing it with Membership.ValidateUser but i dont really know how to set that up hope google can help :)

Collectives™ on Stack Overflow

ASP.NET login validation with database

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related