{urgent} login and passwords

[asp.net]

Anyone here can guild me how to do login and passwords page in before user get in navigate the web pages? Any sample codes or links can provided?

I need VB code as well. and i want to ask what is the differences between the login code in html and vb language? Thanks

[Tjoppie]

Hi asp.net,

I have a table in my db called tusers, I use this way to authenticate them:

Dim UserID As String = 0
            Dim IsActive As Boolean = False
            Dim IsDisabled As Boolean = False
 
            Dim m As New PtechDLL.DBFunctions
            Dim LoginCon As New SqlConnection(m.DBConnectionstring)
 
            Dim LoginSQL As String = "SELECT UserID, Active, AccDisabled FROM tUser WHERE Username='" & Me.txtUsername.Text & "' AND Password='" & Me.txtPassword.Text & "'"
            Dim Login As New SqlCommand(LoginSQL, LoginCon)
            LoginCon.Open()
            Dim LoginRead As SqlDataReader = Login.ExecuteReader
 
 
            If LoginRead.HasRows = False Then
                Me.lblErrors.Text = "Invalid Username or password, please try again"
            Else
                While LoginRead.Read
                    UserID = LoginRead("UserID")
                    IsActive = LoginRead("Active")
                    IsDisabled = LoginRead("AccDisabled")
                End While
                Session.Add("UserID", UserID)
                LoginCon.Close()
                Response.redirect("~/MyDashboard.aspx")
             End if

If the user exists in the database, then the datareader will have rows, then I add the userid field in a session variable called "UserID" which I use for the rest of the site for db functions.

Hope it helps

[mendhak]

The difference is, there is no login code in HTML, strictly speaking.

[asp.net]

erm, what i mean the JavaScript in html page and the javaScript in vb page. Is there any differences?

[mendhak]

Yes. The difference is, you don't use javascript in a vb page. You can use Page.RegisterStartupScript or Page.RegisterClientScriptBlock to send javascript to the html that is output though.

[RobDog888]

If you do it this way then couldnt the credientials be read and also open to an sql injection attack?

"SELECT UserID, Active, AccDisabled FROM tUser WHERE Username='" & Me.txtUsername.Text & "' AND Password='" & Me.txtPassword.Text & "'"

[mendhak]

Yep, yep. 4guys has a sample on parameterized queries if you're too lazy to make SPs.

http://www.4guysfromrolla.com/webtech/092601-1.shtml

[RobDog888]

Thanks, but wasnt that site called 2guys?

[mendhak]

Thanks, but wasnt that site called 2guys?

It was until cloning became legal in their country.

[asp.net]

Dim loginInfo As New MemberDetail
Dim sqlCommand As SqlCommand
Dim sqlDataReader As SqlDataReader

sqlCommand = New SqlCommand("spLogin", sqlConnection)
sqlCommand.CommandType = CommandType.StoredProcedure
sqlCommand.Parameters.Add("@Username", SqlDbType.VarChar, 50).Value = Username.Text
sqlCommand.Parameters.Add("@Password", SqlDbType.VarChar, 50).Value = Password.Text
sqlCommand.Parameters.Add("@login_ID", SqlDbType.Int).Direction = ParameterDirection.Output


sqlConnection.Open()
sqlCommand.ExecuteNonQuery()


Dim Login_ID As Integer = CInt(sqlCommand.Parameters("@Login_ID").Value)
sqlConnection.Close()

If Login_ID > 0 Then
loginInfo.username = Username.Text
loginInfo.load = 1
Session.Add("sessionMember", loginInfo)
Response.Redirect("reservation.aspx")
Else
Dim JSCode As String = ""
JSCode &= "<script language=""javascript"">"
JSCode &= "var smessage='please key in the correct USERNAME and PASSWORD';"
JSCode &= "confirm(smessage)"
JSCode &= "</script>"
RegisterStartupScript("myjscode", JSCode)
Username.Text = ""


End If

Here is my login page. Can anyone here kindly tell me how to add Session in every page, so that the user cannot surf the pages inside if cant log in successful.Thanks.

[asp.net]

any sample codes can provide me arr?

[mendhak]

The simplest way is, in the page load of all your pages

If Session("sessionMember") = "" Then
Response.Redirect("login.aspx")
End If