Member Avatar for davemac001

Hi,

I am trying to create a user login that will allow three different types of users to login...basically an admin, a student and a co-ordiantor.
At the moment i have any registered user logging in and being sent to the admin.aspx page, i am not entirely how to differentiate between the 3 different user types so as to send them to their own.
Here is the code as it stands in the login page c# page....

protected void ValidateUserInfo(string user, string pass)
{
//to establish data base connection
//put your your values for data source,initial_catalog,user_id etc
SqlConnection connection = new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\StudentMonitor.mdf;Integrated Security=True;User Instance=True");
string sql = "SELECT * FROM tblUserType, tblUser, tblUserRoll WHERE username = @username AND password = @password";
SqlCommand cmd = new SqlCommand(sql, connection);
cmd.Parameters.AddWithValue("@username", user);
cmd.Parameters.AddWithValue("@password", pass);
connection.Open();

SqlDataAdapter ad = new SqlDataAdapter(cmd);
DataSet dt = new DataSet();
ad.Fill(dt);

if (dt.Tables[0].Rows.Count > 0)
{ //check if the query returns any data
//Valid Username and Password
Response.Redirect("Admin.aspx");
}
else
{
Response.Write("INVALID Username and Password, Try Again!");
}

connection.Close();
}

any advice, help or pointers would be greatly appreciated as I am only learning much of this as I encounter it....

Edited by kvprajapati because: Added [code] tags.
  • 3 Contributors
  • 3 Replies
  • 2K Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by davemac001

Dani AI

Generated

, the easiest, safest way to split Admin, Student, and Coordinator is to use ASP.NET Membership + Roles (as suggested) and stop hand-rolling that SELECT across three tables. Create the three roles once, assign each user to exactly one role, and keep your login code focused on validating the user and redirecting. Password hashing, lockout, and user GUIDs come for free.

using System.Web.Security;

bool ok = Membership.ValidateUser(username, password);
if (!ok)
{
    FailureText.Text = "Invalid login.";
    return;
}

FormsAuthentication.SetAuthCookie(username, false);

// One place to decide the landing page:
string dest = Roles.IsUserInRole(username, "Admin")       ? "~/Admin.aspx" :
              Roles.IsUserInRole(username, "Student")     ? "~/Student.aspx" :
              Roles.IsUserInRole(username, "Coordinator") ? "~/Coordinator.aspx" :
              "~/Default.aspx";

Response.Redirect(dest);

Do not rely only on redirects for security. Lock each page down in Web.config so a user cannot type the URL and bypass your logic. Repeat the block for Student.aspx and Coordinator.aspx.

<system.web>
  <authentication mode="Forms" />
  <authorization>
    <deny users="?" />
  </authorization>
  <roleManager enabled="true" />
</system.web>

<location path="Admin.aspx">
  <system.web>
    <authorization>
      <allow roles="Admin" />
      <deny users="*" />
    </authorization>
  </system.web>
</location>

To tie your domain tables to the logged-in person (echoing ), store the provider GUID as a foreign key: var userId = (Guid)Membership.GetUser().ProviderUserKey;. Also, deploy Membership to a shared SQL Server (not App_Data) so publishing new builds does not overwrite your production users.

Recommended Answers

All 3 Replies

Member Avatar for gillivt

Try using asp.nets built in membership/roles

sample tutorial video and download code here:

Member Avatar for CrappyCoder

The only issue you will have is ensuring you can update the tables in your database using the logged-in user's identity (which is GUID based)

Otherwise the memebrship/roles will do nearly everything you need.

Be advised that the Membership data resides in your App_Data folder unless you specifically point to an external database - A few people I know have overwritten this membership data in a production environment when they FTP a new release of their web application with the local membership data

Edited by CrappyCoder because: n/a
Member Avatar for davemac001

Thanks very much for the help guys, hopefully this will do the trick.

Dave :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.