asp.net Login Website from database

Question

I have a website with a login, from a database.

This is my code :

        protected void SignIn_Click(object sender, EventArgs e)
        {
            SqlConnection con = new SqlConnection("Data Source=MICROSOF-58B8A5\\SQL_SERVER_R2;Initial Catalog=Movie;Integrated Security=True");
            con.Open();

            string cmdStr = "select count(*) from Users";

            cmdStr += "where Username='" + UsernameSignIn.Text + "'";
            cmdStr+= "AND Password='"+PasswordSignIn.Text+"'";

            SqlCommand cmd = new SqlCommand(cmdStr, con);

            int i = Convert.ToInt16(cmd.ExecuteScalar());

            if (i == 0)
            {
                ErrorSignIn.Text = "Sorry, Wrong Username or Password";
            }
            else
            {
                Response.Redirect("HomeAfter.aspx");
            }
        }

for some reason, I run into an error :

Incorrect syntax near '-'

. (for this line : int i = Convert.ToInt16(cmd.ExecuteScalar()); )

Thanks,

danludwig · Accepted Answer · 2011-12-16 22:54:53Z

2

There is no spacing. Your query looks like this:

select count(*) from Userswhere Username='...'AND Password='...'

Add spaces, like so:

string cmdStr = "select count(*) from Users";
cmdStr += " where Username='" + UsernameSignIn.Text + "'";
cmdStr+= " AND Password='"+PasswordSignIn.Text+"'";

answered Dec 16, 2011 at 22:54

danludwig

47.3k27 gold badges164 silver badges240 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Peter Bromberg · Accepted Answer · 2011-12-17 00:10:01Z

1

Aside from the fact that this is particularly crude as a form of authentication (you really ought to consider using the built-in ASP.NET Membership provider(s)) you should at a minimum be using parameterized SQL queries, rather than concatenating plain text to create your SQL statement. Also, I notice that your "login" arrangement simply does a response.redirect to the HomeAfter.aspx page without storing anything to be re-used that will indicate the user has already successfully logged in, such as a cookie or a sesssion variable.

Is there any particular reason for all this, or is it because you're just starting out and you need to study up a bit?

answered Dec 17, 2011 at 0:10

Peter Bromberg

1,5148 silver badges12 bronze badges

Collectives™ on Stack Overflow

asp.net Login Website from database

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related