在asp.net中使用会话时出现错误

Question

I have 2 tables Users and Hobbies . userId is primary key in Users table and it is foreign key in Hobbies table. I want same table. I want same userId in both tables. When user logged in he gets in both tables. When user logged in he gets userId . On next page there is hobbies page where user have to fill info and the same . On next page there is hobbies page where user have to fill info and the same userId` should get saved into Hobbies table. I am using session for this, but it is giving exception as

"Error converting datatype object to int."

My code is:

this is a code on Users Page

protected void loginbtn_Click(object sender, EventArgs e)
{
    SqlCommand cmd1 = new SqlCommand("select UserId from Users where username=@username and password=@password",con);
    Session["ID"] = cmd1;
}

and this is the code on hobbies:

protected void Button4_Click(object sender, EventArgs e)
{
    int id= Convert.ToInt32(Session["ID"]);
    cmd.Parameters.AddWithValue("@UserId",id);
    con.Open();
    cmd.ExecuteNonQuery();
}

I am new to sessions and stored procedure. This is my first web app. Please help me to improve.

Answer 1

You shouldn't store a command in a session let along convert it to a integer .

loginbtn_Click

protected void loginbtn_Click(object sender, EventArgs e)
{
    string conString = "xxxxxxxxxxxxxxxxxxxxxxxx";
    using (SqlConnection con = new SqlConnection(conString))
    {
        con.Open();
        using (var cmd = new SqlCommand(
        "select UserId from Users where username=@username and password=@password",
        con))
        {
            cmd.Parameters.AddWithValue("@username", username.Text);
            cmd.Parameters.AddWithValue("@password", password.Text);
            var id = cmd.ExecuteScalar();
            Session["ID"] = id;

        }
    }
}

Button4_Click

protected void Button4_Click(object sender, EventArgs e)
{
    string conString ="xxxxxxxxxxxxxxxxxxxxxxxxxx";
    using (SqlConnection con = new SqlConnection(conString))
    {
        con.Open();
        using (var cmd = new SqlCommand("select * from Users where UserId=@UserId",con))
        {
            var id= Convert.ToInt32(Session["ID"]);
            cmd.Parameters.AddWithValue("@UserId",id);
            using (SqlDataReader reader = cmd.ExecuteReader())
            {
                //get the data
            }       
        }
    }
}

Answer 2

You need to execute the SQLCommand first to get the value of your UserID . Right now, you are passing an SQLCommand object, which obviously isn't an integer value. To fix the error, you would need to do something like this:

using (SqlConnection con = new SqlConnection (connectionstring))
{
 SqlCommand cmd1 = new SqlCommand("select UserId from Users where username=@username and password=@password",con);
 cmd.Parameters.AddWithValue("@username", username.Text);
 cmd.Parameters.AddWithValue("@password", password.Text);
 con.Open();
 int UID = (int)cmd1.ExecuteScalar(); //Execute command and assign value
 Session["ID"] = UID; //Now set session variable
}

Of course, you need to handle exceptions and so on, but this should get you started.

Answer 3

First i want to notify you that you are storing the command object into the Session and not the UserID . so you are getting this error!

On Users.aspx Page:

Storing UserID in session:

 using (SqlConnection con = new SqlConnection (yourConnectionString))
    {
     SqlCommand mycmd = new SqlCommand("select UserId from Users where  username=@username and password=@password",con);
    //add parameters to pass the username & password here
      mycmd.Parameters.AddWithValue("@username", username.Text);
      mycmd.Parameters.AddWithValue("@password", password.Text);
     if (con.State != ConnectionState.Open)
      {
           con.Close();
           con.Open();
      }

     int userID = (int)mycmd.ExecuteScalar();
     Session["UserID"] = userID; //Store USerID in session
     con.Close();
    }

The reason I'm not simply using:

if (con.State == ConnectionState.Closed)
{
    con.Open();
}

Is because the ConnectionState can also be:

Broken, Connnecting, Executing, Fetching

Additionally Microsoft states that Closing, and then Re-opening the connection "will refresh the value of State." More Details

On Hobbies.aspx Page:

Using Session UserID:

if(Session["UserID"]!=null)
{
int userID=Convert.ToInt32(Session["UserID"])
//do other stuff
}

Insert Into Hobbies table:

private void btnInsertHobbies_Click(object sender, EventArgs e)
    {
        int userID=0;
        if(Session["UserID"]!=null)
        {
          userID=Convert.ToInt32(Session["UserID"]);
        }

        //add Here fields of hobbies table
        string hobby1= textBox2.Text;
        string hobby2= textBox3.Text;
        if (conn2.State != ConnectionState.Open)
        {
           conn2.Close();
           conn2.Open();
        }

        SqlCommand cmd = new SqlCommand();
        cmd.Connection = conn2;
        cmd.CommandText = "INSERT INTO Hobbies(userID, hobby1, hobby2)   VALUES(@userID,@hobby1,@hobby2)";

        cmd.Parameters.AddWithValue("@userID", userID);
        cmd.Parameters.AddWithValue("@hobby1", hobby1);
        cmd.Parameters.AddWithValue("@hobby2", hobby2);

        cmd.ExecuteNonQuery(); 

        conn2.Close();
    }

NOTE: please make changes according to your table fields and mark as answer if it help you!