Member Avatar for Alv45525
Alv45525 0 Light Poster

helo guys...i have a table in sql server express edition and 3 fields in it,
UserID, Password and Role.
I managed to create my login but now i want to add some piece of code in order to give acces according to the role field..that is admin and user will have different priviledges.

Dim txtcontent As String
        Dim logCon As New SqlConnection("Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\Database.mdf;Integrated Security=True;User Instance=True")

        txtcontent = Me.txt1.Text

        Dim LogCmd As New SqlCommand("select * from Security where UserID='" & txtcontent & "'", logCon)
        logCon.Open()

        Dim rdr As SqlDataReader = LogCmd.ExecuteReader
        If rdr.Read Then

            Dim p As String = rdr(1)
            Dim UserRole As String
            If txt2.Text = p Then
[QUOTE]i suppose that the piece f code should be written here but i have no idea about how to do it[/QUOTE]


                Response.Redirect("home.aspx")

            Else
                MsgBox(" Invalid Password!! Please try again ")
                txt2.Text = ""
                txt2.Focus()
            End If

        Else
            MsgBox(" Invalid Username!! Please try again ")

            txt1.Text = ""
            txt2.Text = ""
            txt1.Focus()
        End If

        logCon.Close()

anyone can help plz

  • 1 Contributor
  • 0 Replies
  • 124 Views

Dani AI

Generated

— your login flow is fine as a starting point, but two things should be added: secure database access (parameterized queries + proper disposal of connections) and role-aware routing that does not rely only on a single redirect. The snippet below shows a safer pattern: fetch the stored hash+salt and the role, verify the password, then redirect based on role. Put the connection string in web.config and avoid MsgBox in web code — use a label or validation summary instead.

' VB.NET (outline)
Dim conn = ConfigurationManager.ConnectionStrings("MyDb").ConnectionString
Using cn As New SqlConnection(conn)
    Using cmd As New SqlCommand("SELECT PasswordHash, Salt, Role FROM Users WHERE UserID=@id", cn)
        cmd.Parameters.AddWithValue("@id", txtUser.Text.Trim())
        cn.Open()
        Using rdr = cmd.ExecuteReader()
            If rdr.Read() Then
                Dim stored = CType(rdr("PasswordHash"), Byte())
                Dim salt = CType(rdr("Salt"), Byte())
                Dim role = rdr("Role").ToString()
                ' compute input hash with same salt (PBKDF2)
                Using derive As New System.Security.Cryptography.Rfc2898DeriveBytes(txtPass.Text, salt, 10000)
                    Dim inputHash = derive.GetBytes(stored.Length)
                    If inputHash.SequenceEqual(stored) Then
                        ' successful login; then route by role
                        If String.Equals(role, "admin", StringComparison.OrdinalIgnoreCase) Then
                            Response.Redirect("admin.aspx")
                        Else
                            Response.Redirect("home.aspx")
                        End If
                    Else
                        ' show generic "invalid credentials"
                    End If
                End Using
            Else
                ' generic "invalid credentials"
            End If
        End Using
    End Using
End Using

Use parameterized commands to avoid SQL injection (SqlParameter docs). Do not store plaintext passwords — use a salted PBKDF2 hash like Rfc2898DeriveBytes (docs). Finally, enforce role checks on every protected page (or use Forms Authentication/role provider) rather than trusting a single redirect. Quick troubleshooting: trim inputs, compare roles case-insensitively, ensure the DB types map correctly (varbinary for hashes), and keep error messages generic to avoid username enumeration.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.