Getting the register/ login feature to work

ASP Free Forums Sponsor:

Ajax Application Generator Generate database and reporting .NET Web apps in minutes. Quickly create visually stunning, feature-rich apps that are easy to customize and ready to deploy. Download Now!

April 15th, 2008, 03:01 PM

magic30

Registered User

Join Date: Apr 2008

Posts: 18

Time spent in forums: 3 h 45 m 25 sec
Reputation Power: 0

Getting the register/ login feature to work

can someone please help me to fix my webpage.
i have created a register page which links to a database in visual web devloper. now when i try to login to the site with those detils i dont know if it works. what i have been trying to do is shown when the user is login by display their name.

this is the code for the home page where the login is.

Code:

<asp:Label ID="lblError" runat="server" ForeColor="Red" Style="z-index: 102; left: 716px;
            position: absolute; top: 128px"></asp:Label>
        <asp:Label ID="Label3" runat="server" Text="User" style="z-index: 103; left: 647px; position: absolute; top: 55px"></asp:Label>
        <asp:TextBox ID="txtUserName" runat="server" style="z-index: 104; left: 720px; position: absolute; top: 54px"></asp:TextBox>
        <asp:Label ID="Label4" runat="server" Text="Password" Width="52px" style="z-index: 105; left: 647px; position: absolute; top: 88px"></asp:Label>
        <asp:TextBox ID="txtPassword" runat="server" style="z-index: 106; left: 721px; position: absolute; top: 85px"></asp:TextBox>
        <asp:Button ID="btnButton" runat="server" Text="Login" style="z-index: 107; left: 649px; position: absolute; top: 125px" /><br />
        <

this is the code for the register form that links to the database

    Protected Sub btnRegister_Click(ByVal sender As Object, ByVal e As System.EventArgs)
        Dim sqlConnect As System.Data.SqlClient.SqlConnection
        Dim sqlInsertCommand As System.Data.SqlClient.SqlCommand
        Dim addStr As String
        
        addStr = "('" & txtUser.Text & "','" & txtPassword.Text & "','" & txtConfirm.Text & "','" & txtName.Text & "','" & txtSurname.Text & "','" & txtHouseNo.Text & "','" & txtStreet.Text & "','" & txtTown.Text & "','" & txtPostCode.Text & "','" & txtTelNo.Text & "','" & txtMobile.Text & "','" & txtEmail.Text & "')"
        
        sqlConnect = New System.Data.SqlClient.SqlConnection("Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirector  y|\MediaDirect.mdf;Integrated Security=True;User Instance=True")
        
        sqlConnect.Open()
        
        sqlInsertCommand = New System.Data.SqlClient.SqlCommand("INSERT INTO Customer ([UserName],[Password],[ConfirmPassword],[Name],[SurName],[HouseNo],[StreetName],[Town],[Postcode],[Telephone],[Mobile],[EmailAddress]) VALUES" & addStr, sqlConnect)
        
        sqlInsertCommand.ExecuteNonQuery()
        sqlConnect.Close()
        
        Response.Redirect("RegisterComplete.aspx")
    End Sub

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs)

    End Sub

Last edited by lewy : April 15th, 2008 at 10:47 PM. Reason: Added [code][/code] tags, please do this yourself next time

April 16th, 2008, 01:02 AM

magic30

Registered User

Join Date: Apr 2008

Posts: 18

Time spent in forums: 3 h 45 m 25 sec
Reputation Power: 0

can someone guide me where im am going wrong

April 16th, 2008, 08:36 AM

Wolffy

Slaprentice of Wolves

Join Date: Aug 2007

Location: Mossville, IL

Posts: 1,246

Time spent in forums: 1 Week 6 Days 19 h 54 m 25 sec
Reputation Power: 423

Quote:

Originally Posted by magic30

can someone guide me where im am going wrong

Can't tell from you have posted. The two code segments seem to be totally unrelated.

After the Click event executes, have you looked at your table with SQL Management Studio? Was the record inserted like you expected? I assume that the query executes, since you are not getting an exception.

The other is just ASP mark-ups that in themselves don't DO anything. What do you expect to be displayed? I don't see a click event for your button.

__________________
Wolffy
------------------------
Opinions expressed are my own and do not necessity reflect those of any sane person. Any code provided is intended to be an example and is provided AS IS. Rework for your specific environment may be required. Void where prohibited by law. Not valid in California. Your mileage may vary. Not FDIC insured

April 16th, 2008, 09:51 AM

magic30

Registered User

Join Date: Apr 2008

Posts: 18

Time spent in forums: 3 h 45 m 25 sec
Reputation Power: 0

the register details works fine. the details get stored into the database. but when i try to login using those details nothing happens. the user should be able to login and their name should display

April 16th, 2008, 09:59 AM

Wolffy

Slaprentice of Wolves

Join Date: Aug 2007

Location: Mossville, IL

Posts: 1,246

Time spent in forums: 1 Week 6 Days 19 h 54 m 25 sec
Reputation Power: 423

Quote:

Originally Posted by magic30

the register details works fine. the details get stored into the database. but when i try to login using those details nothing happens. the user should be able to login and their name should display

OK. But what you have posted here doesn't DO anything. What happens when you 'try to Login'? I assume you mean you click the button btnButton, but either you don't have any code written for this button's click event, or you haven't posted it.

April 16th, 2008, 10:17 AM

magic30

Registered User

Join Date: Apr 2008

Posts: 18

Time spent in forums: 3 h 45 m 25 sec
Reputation Power: 0

this is the only code i have
<asp:Button ID="btnButton" runat="server" Text="Login" style="z-index: 107; left: 649px; position: absolute; top: 125px" />

April 16th, 2008, 10:27 AM

Wolffy

Slaprentice of Wolves

Join Date: Aug 2007

Location: Mossville, IL

Posts: 1,246

Time spent in forums: 1 Week 6 Days 19 h 54 m 25 sec
Reputation Power: 423

Quote:

Originally Posted by magic30

this is the only code i have
<asp:Button ID="btnButton" runat="server" Text="Login" style="z-index: 107; left: 649px; position: absolute; top: 125px" />

Right. So the button is just a button and isn't doing anything. You need to provide the code for the click event in the code-behind. Since you have the INSERT code (which appears to handle a Click Event), I assume you can handle a simple SELECT to actually query the database.

[edit]Now I see again that you are using VWD, which I'm not familiar with. I don't know if that uses separate files for code, or if the code is in the aspx page. Either way, you need to put it someplace.[/edit]

Last edited by Wolffy : April 16th, 2008 at 10:29 AM.

April 16th, 2008, 10:41 AM

magic30

Registered User

Join Date: Apr 2008

Posts: 18

Time spent in forums: 3 h 45 m 25 sec
Reputation Power: 0

sorry how do i do that
the code for the click event in the code-behind.

April 16th, 2008, 11:14 AM

Wolffy

Slaprentice of Wolves

Join Date: Aug 2007

Location: Mossville, IL

Posts: 1,246

Time spent in forums: 1 Week 6 Days 19 h 54 m 25 sec
Reputation Power: 423

You coded the register button;s click event -- just do the same for your login button and query your database.

You may also want to look at http://www.asp101.com/lessons/

#10

April 16th, 2008, 12:22 PM

magic30

Registered User

Join Date: Apr 2008

Posts: 18

Time spent in forums: 3 h 45 m 25 sec
Reputation Power: 0

Does this look right?

Code:

  <script runat="server">

    Protected Sub btnLogin_Click(ByVal sender As Object, ByVal e As System.EventArgs)
        Dim sqlConnect As System.Data.SqlClient.SqlConnection
        Dim sqlCommandDB As System.Data.SqlClient.SqlCommand
        Dim sqlInsertCommand As System.Data.SqlClient.SqlCommand
        Dim toCommandCus As System.Data.SqlClient.SqlCommand = New System.Data.SqlClient.SqlCommand
        Dim toAdapt As System.Data.SqlClient.SqlDataAdapter = New System.Data.SqlClient.SqlDataAdapter
        Dim toCustomer As System.Data.DataSet = New System.Data.DataSet
        Dim toCustomerName As System.Data.SqlClient.SqlCommand

        sqlConnect = New System.Data.SqlClient.SqlConnection("Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirector  y|\MediaDirect.mdf;Integrated Security=True;User Instance=True")
        
        sqlConnect.Open()
        
sqlConnect = New System.Data.SqlClient.SqlCommand("SELECT [Password] FROM [Customer] WHERE [Username] = '" txtUsername.Text & “’”, sqlConnect) 
        'Query to select the password
                     
        toCustomerName = New System.Data.SqlClient.SqlCommand("SELECT [name] FROM [Customer] WHERE [Username] = '" & txtUserName.Text & "'", sqlConnect)
      
        'Create a datareader to read the field on the database
        
        Dim DataRead As System.Data.SqlClient.SqlDataReader
               
        DataRead = SqlCommand.ExecuteReader(System.Data.CommandBehavi  or.SingleResult)
                
                      
        If DataRead.Read() Then
            
            If DataRead("Password").ToString = txtPassword.Text Then
                 
                lblName.Text = "Welcome " & toCustomerName.ExecuteScalar & " To Media Direct"
                lblError.Text = ""
                                
            Else
                'Error message appears when the Username field matches the data in the database but the password doesn't match 
                lblError.Text = "Cannot find your Password"
                lblError.ForeColor = Drawing.Color.Red
                lblName.Text = ""
                                                
            End If
            
        Else
            'Error message appears when Username doesn't match the database entry
            lblError.Text = "Cannot find anything"
            lblError.ForeColor = Drawing.Color.Red
            lblName.Text = ""
        End If
            
        DataRead.Close()
       
        sqlConnect.Close()
        
    End Sub
</script>

#11

April 16th, 2008, 12:57 PM

Wolffy

Slaprentice of Wolves

Join Date: Aug 2007

Location: Mossville, IL

Posts: 1,246

Time spent in forums: 1 Week 6 Days 19 h 54 m 25 sec
Reputation Power: 423

And excellent first attempt. You've got a few things wrong, and you are making it more difficult than necessary.

VB.NET Code:

Original - VB.NET Code

Protected Sub btnButton_Click(ByVal sender As Object, ByVal e As System.EventArgs)
    Dim sqlConnect As System.Data.SqlClient.SqlConnection
    Dim sqlCommandDB As System.Data.sqlClient.sqlCommand
    Dim customerName as String
    Dim obj as Object
 
  sqlConnect = New System.Data.SqlClient.SqlConnection(Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirector  y|\MediaDirect.mdf;Integrated Security=True;User Instance=True")
  sqlCommandDB = New System.Data.SqlClient.SqlConnection("SELECT [name] FROM [Customer] WHERE [Username] = '" txtUsername.Text & "' AND [Password] = '" txtPassword.Text & "'")
  Try
    sqlConnect.Open()
    obj = sqlCommandDB.ExecuteScalar
    If (obj = Nothing) Then
      lblError.Text = "Invalid Userid Or Password"
      lblError.ForeColor = Drawing.Color.Red
      lblName.Text = String.Empty
      dataCustomer.Visible = False
    Else
      lblName.Text = String.Format("Welcome {0} To Media Direct", Convert.ToString(obj))
      dataCustomer.Visible = True
      lblError.Text = String.Empty
    End If
  Catch ex as Exception
    lblError.Text = "Oops, something bad happened, call the administrator"
  Finally
    sqlConnect.Close()
  End Try
End Sub

Line 1-6: Pretty much as in your code -- shouldn't need an explanation

Line 7 Creates your connection object using the connection string provided

Line 8 Creates your command object and links to your connection object

Line 9 Starts your Try..Catch..Finally block, which should always be used around SQL code.

Line 10: Opens the connection

Line 11: Executes the query and returns the first column of the first row -- since the query will return only 1 string -- this works great here

Line 12: If the query didn't match the Userid and Password, then obj will be set to Nothing (or Null for you C#'ers out there)

Line 13-16: You really shouldn't give the user a clue that the password was wrong but the userid is valid. Let 'em guess.

Line 18-20 Displays you welcome message if the query returns something

Line 22-23 Catches an exception should something go wrong. Probably a good idea to actually do something with it other then use my static message. Look at SqlExecption class

Line 24-25 The Finally block will close the connection to the database regardless of what happens in the Try...Catch.

I've also included other .NET'y things that you can look up. String.Empty should be pretty obvious. String.Format is really cool and should save you from concat'ing strings together.

Final comment. Once you have the above working, look at SqlParameter class. You will REALLY REALLY want to use parameters and NEVER NEVER NEVER build an SQL string like this. As an exercise to the reader, consider what would happen if I enter the following for my user id:

A' OR 1=1; DELETE * FROM CUSTOMER; --

Hope this helps.

#12

April 16th, 2008, 01:15 PM

magic30

Registered User

Join Date: Apr 2008

Posts: 18

Time spent in forums: 3 h 45 m 25 sec
Reputation Power: 0

i tried this

Code:

Protected Sub btnLogin_Click(ByVal sender As Object, ByVal e As System.EventArgs)
		Dim sqlConnect As System.Data.SqlClient.SqlConnection
		Dim sqlCommandDB As System.Data.SqlClient.SqlCommand
		Dim sqlInsertCommand As System.Data.SqlClient.SqlCommand
		Dim toCommandCus As System.Data.SqlClient.SqlCommand = New System.Data.SqlClient.SqlCommand
		Dim toAdapt As System.Data.SqlClient.SqlDataAdapter = New System.Data.SqlClient.SqlDat