分割用户名和密码凭证

Question

I have created the following WebMethod in the back end of my application where the users login through the front end.

[WebMethod]
    public String Login(String userName, String password)
    {

            OleDbConnection connect = new OleDbConnection(connection);
            connect.Open();
            OleDbCommand command = new OleDbCommand("Select * from login where userName='" + userName + "'  and password ='" + password + "'", connect);
            command.CommandType = CommandType.Text;
            OleDbDataAdapter adapter = new OleDbDataAdapter();
            adapter.SelectCommand = command;
            DataSet NSNSet = new DataSet();
            adapter.Fill(NSNSet);

            string username = NSNSet.Tables[0].Rows[0]["firstName"].ToString() + NSNSet.Tables[0].Rows[0]["lastName"].ToString();

            int userID = System.Convert.ToInt16(NSNSet.Tables[0].Rows[0]["UID"].ToString());

            return username + "," + userID;


    }

Currently, I have error handling in place which states -

catch(Exception ex)
            {
                string error = System.Convert.ToString(ex);
                if (error.Contains("There is no row at position 0"))
                {
                    status.Text = "Incorrect Username/Password combination";
                }
            }

This works fine, however how could I aulter my code so that it brings back a more specific error, ie states if the userName or password specifically are incorrect?

Answer 1

Don't give out to much details, just give a simple login error message, but don't say that username is incorrect or password is incorrect, cause a hacker can use that information

a simple text saying login unsuccessful should be ok

Answer 2

You should do like this:

public String Login(String userName, String password)
    {
        OleDbConnection connect = new OleDbConnection(connection);
        connect.Open();

        OleDbCommand command = new OleDbCommand("Select UID, firstName, lastName from login where userName=?  and password =?", connect);
        command.CommandType = CommandType.Text;

        //to avoid sql injection
        command.Parameters.Add(userName);
        command.Parameters.Add(password);

        OleDbDataAdapter adapter = new OleDbDataAdapter();
        adapter.SelectCommand = command;
        DataSet NSNSet = new DataSet();
        adapter.Fill(NSNSet);

        if (NSNSet.Tables[0].Rows.Count == 0)
            return "Access denied";

        string username = NSNSet.Tables[0].Rows[0]["firstName"].ToString() + NSNSet.Tables[0].Rows[0]["lastName"].ToString();
        int userID = int.Parse(NSNSet.Tables[0].Rows[0]["UID"].ToString());
        return username + "," + userID;
    }

Or a better way, using DataReader for performance:

public String Login(String userName, String password)
    {

        OleDbConnection connect = new OleDbConnection(connection);
        connect.Open();

        OleDbCommand command = new OleDbCommand("Select UID, firstName, lastName from login where userName=?  and password =?", connect);
        command.CommandType = CommandType.Text;

        //to avoid sql injection
        command.Parameters.Add(userName);
        command.Parameters.Add(password);

        OleDbDataReader reader=command.ExecuteReader();
        if (reader.Read())
        {
            //that means there's at least one row
            string username = reader["firstName"] + " " + reader["lastName"];
            int userID = int.Parse(reader["UID"].ToString());
            return username + "," + userID;
        }
        else
        {
            //no combination username-password found
            return "Access denied";
        }
    }

Answer 3

First, this code is open to SQL injection. Second, if you want to know specifically which element is incorrect, you have to break down your query into two components (ie. query username and password separately)

Answer 4

You can change you select query a little bit to this:

"select * from login where userName='"+userName+"'";

if there is no row in DataSet then write

Invalid UserName

and if user exist then check if password match or not if not match then write

Invalid Password