登录身份验证逻辑在C＃.NET中不起作用

Question

i have the table user_info created and with 2 username and password in it. When i execute the below code,it always goes into the "else" condition even if i type hte correct username and password.

protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
{
    string v = System.Configuration.ConfigurationManager.ConnectionStrings["harish"].ConnectionString;
    con = new OracleConnection(v);
    con.Open();

    cmd = new OracleCommand("select * from user_info where username='" + Login1.UserName.Trim() + "' and password='" + Login1.Password + "'", con);
    dr = cmd.ExecuteReader();
    dr.Read();
    if (dr.HasRows)
    {
        Response.Redirect("Default2.aspx");
    }
    else
    {
        Response.Redirect("Default.aspx");
    }


    con.Close();
    dr.Close();
}

Answer 1

It is going in to the else because the dr has no rows. To find out why, put a break point on

dr = cmd.ExecuteReader();

then take the actualy sql select command with the parameters and run this as a sql statement against the db to see if it returns rows. My Suspicion is that whatever you think is feeding Login1.Username and/or Login1.Password is passing nothing across but hard to say without knowing how Login1 is filled.

Btw, if these are textboxes on a web page then you need to use Login1.Username.Text and Login1.Password.Text to get the actual string that is in the textbox.

Answer 2

First things first, you should at a minimum be hashing the password. Also it's best practice to not leave your connections at a class level. They should be created, opened, and closed when you use them. Same with commands, readers, etc...This can be done very easily with a using block.

Next, ensure you are accessing the actual string values and not controls when using Login1.UserName and Login1.Password. If you're using controls, you need to use Login1.UserName.Text.Trim() and Login1.Password.Text.Trim(). You can ensure this by storing the query you build into a local string value and seeing what's actually built.

Do not use the DataReader for what you are doing. Instead use the ExecuteScalar method:

protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
{
    string v = System.Configuration.ConfigurationManager.ConnectionStrings["harish"].ConnectionString;
    con = new OracleConnection(v);
    con.Open();

    cmd = new OracleCommand("select * from user_info where username='" + Login1.UserName.Trim() + "' and password='" + Login1.Password + "'", con);
    int count = Convert.ToInt32(cmd.ExecuteScalar());
    if (count > 0)
    {
        Response.Redirect("Default2.aspx");
    }
    else
    {
        Response.Redirect("Default.aspx");
    }

    con.Close();
}

Once you have this setup, put a breakpoint on the if (count > 0) line. Check your query that's stored in the local var and check the count. This should give you all you need.