what is problem with this code for Login with role

Question

this is the code what's wrong with it

        protected void btnLogin_Click(object sender, EventArgs e)
        {
            SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["cn"].ConnectionString);
            con.Open();
            SqlCommand cmd = new SqlCommand("select * from Users where UserName =@username and Password=@password", con);
            SqlCommand cmd1= new SqlCommand("select RoleId from Users where UserName =@username and Password=@password", con);

            cmd.Parameters.AddWithValue("@username", txtUserName.Value);
            cmd.Parameters.AddWithValue("@password", txtPassword.Value);
            SqlDataAdapter da = new SqlDataAdapter(cmd);
            DataTable dt = new DataTable();
            da.Fill(dt);
            if (dt.Rows.Count > 0)
            {
                Session["User_Name"] = txtUserName.Value;
                Response.Redirect("~/Admin/Admin.aspx");
                Session.RemoveAll();
            }

            else 
            {
                ClientScript.RegisterStartupScript(Page.GetType(), "validation", "<script language='javascript'>alert('Invalid Username and Password')</script>");
            }


        }

Answer 1

Hi @khalid saeed,

I tested your code and there is no problem, you check that your username and password are entered correctly.

 <input type="text" id="txtUserName" runat="server" />
            <input type="text" id="txtPassword" runat="server" />          
            <asp:Button ID="Button1" runat="server" Text="Button" OnClick="btnLogin_Click" />

protected void btnLogin_Click(object sender, EventArgs e)
        {
            SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["cn"].ConnectionString);
            con.Open();
            SqlCommand cmd = new SqlCommand("select * from Users where UserName =@username and Password=@password", con);
            SqlCommand cmd1 = new SqlCommand("select RoleId from Users where UserName =@username and Password=@password", con);

            cmd.Parameters.AddWithValue("@username", txtUserName.Value);
            cmd.Parameters.AddWithValue("@password", txtPassword.Value);
            SqlDataAdapter da = new SqlDataAdapter(cmd);
            DataTable dt = new DataTable();
            da.Fill(dt);
            if (dt.Rows.Count > 0)
            {
                Session["User_Name"] = txtUserName.Value;
                Response.Redirect("~/Admin/Admin.aspx");
                Session.RemoveAll();
            }

            else
            {
                ClientScript.RegisterStartupScript(Page.GetType(), "validation", "<script language='javascript'>alert('Invalid Username and Password')</script>");
            }


        }

Best regards,
Lan Huang

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

what is the unexpected behavior? what is the design of the tables? does the password using hashing and a salt?