Member Avatar for Haimanti

Hi,

i have a user table in backend with many columns n from that i need to user the email id and password for login. I have read the data in my code using a data reader, but am not getting how to match the entered username and password by user with the backend data.
If any one can pls guide with same...
Thanks

protected void btnLogin_Click(object sender, EventArgs e)
    {
        //string cmd1 = ("Select email, password from fwm_user");
        //DataSet ds;
        //SqlDataAdapter da = new SqlDataAdapter(cmd1, conn1);
        //da.Fill(ds, "fwm_user");
        
        SqlCommand cmd1 = ("Select email, password from fwm_user");  
        SqlDataReader dr;
        dr = cmd1.ExecuteReader();

        if (dr.Read())
        { 
            if(dr.GetString ........??????????????
        }
        
            }
  • 2 Contributors
  • 2 Replies
  • 83 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by Haimanti

Dani AI

Generated

As showed, the immediate problem is matching the entered email/password to the DB. The code posted by works for a quick demo, but it leaves out important production concerns: it reads every row, appears to rely on plaintext passwords, and is vulnerable to SQL injection and timing attacks. The safer, scalable pattern is: fetch only the user row for the supplied email, verify the password using a salted hash, and then create an authenticated session.

Keep the login flow simple and safe:

  1. At registration store a strong salted hash (PBKDF2, bcrypt or Argon2), not the raw password.
  2. On login SELECT only the row for the given email (parameterized). Retrieve the stored salt and hash, compute the hash for the supplied password, and compare using a constant-time comparison. Use using blocks so DB connections and readers are always closed.
  3. On success issue the auth cookie/session (Forms Authentication, OWIN/ASP.NET Identity) and redirect.

A compact example (illustrative only — not the same as the posts above):

using (var conn = new SqlConnection(connString))
using (var cmd = new SqlCommand("SELECT PasswordHash, Salt FROM fwm_user WHERE Email = @email", conn))
{
    cmd.Parameters.Add("@email", SqlDbType.NVarChar, 256).Value = email;
    conn.Open();
    using (var rdr = cmd.ExecuteReader())
    {
        if (!rdr.Read()) { /* invalid */ }
        // compute PBKDF2(inputPassword, salt) and compare to stored hash
    }
}

Extra cautions: run login over HTTPS, throttle/lock accounts after repeated failures, avoid verbose "email not found" messages, and prefer ASP.NET Identity or a vetted membership library for production systems.

Recommended Answers

All 2 Replies

Member Avatar for chithrasujith 
SqlConnection con = new SqlConnection("Data Source=SECANT-B0A227A3;Initial Catalog=Logins;integrated security=True;");
        SqlCommand cmd = new SqlCommand("select email,password from login", con);
        con.Open();
        SqlDataReader rdr = cmd.ExecuteReader();
        while (rdr.Read())
        {
           
            if ( txtboxemail.Text.Trim()==rdr[0].ToString().Trim() && textboxpassword.Text.Trim()==rdr[1].ToString().Trim())
            {
                Response.Redirect("~/Home.aspx");
            }
        }
Member Avatar for Haimanti

Thank you so much. Now i can proceed further.[:)]

SqlConnection con = new SqlConnection("Data Source=SECANT-B0A227A3;Initial Catalog=Logins;integrated security=True;");
        SqlCommand cmd = new SqlCommand("select email,password from login", con);
        con.Open();
        SqlDataReader rdr = cmd.ExecuteReader();
        while (rdr.Read())
        {
           
            if ( txtboxemail.Text.Trim()==rdr[0].ToString().Trim() && textboxpassword.Text.Trim()==rdr[1].ToString().Trim())
            {
                Response.Redirect("~/Home.aspx");
            }
        }
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.