Calling C# functions from a button onclick event

Question

I am trying to call a function from a button onclick event but it is not executing the function. Below is the code:

<script runat="server">

    protected void RegistrationButton_Click(object sender, EventArgs e)
    {
        TextBox un = Post0.FindControl("aspxTextBox_UserName") as TextBox;
        TextBox pwd = Post0.FindControl("aspxTextBox_Password") as TextBox;
        TextBox cpwd = Post0.FindControl("aspxTextBox_ConfirmPassword") as TextBox;
        TextBox txtE = Post0.FindControl("aspxTextBox_Email") as TextBox;
        TextBox SQ = Post0.FindControl("aspxTextBox_SecurityQ") as TextBox;
        TextBox SA = Post0.FindControl("aspxTextBox_SecurityA") as TextBox;

        if (pwd == cpwd)
        {
            System.Data.SqlClient.SqlConnection sqlConnection1 = new System.Data.SqlClient.SqlConnection("ConString_Online_EMS_AFRICA_db");

            System.Data.SqlClient.SqlCommand cmd = new System.Data.SqlClient.SqlCommand();
            cmd.CommandType = System.Data.CommandType.Text;
            cmd.CommandText = "INSERT INTO EMSPWD (Username, Password, Email, SecurityQ, SecurityA) VALUES (" + un + ", " + pwd + ", " + txtE + ", " + SQ + ", " + SA + " )";
            cmd.Connection = sqlConnection1;

            sqlConnection1.Open();
            cmd.ExecuteNonQuery();
            sqlConnection1.Close();

            Response.Redirect("02_Registration.aspx");
        }
        else
        {
            Console.WriteLine("Passwords don't Match");
        }
    }
</script>

<asp:Button ID="RegistrationButton_Click" runat="server" CssClass="emsafrica-button" Text="Click to Create User Account" ValidationGroup="Login1" onclick="RegistrationButton_Click" TabIndex="7"/>

Answer 1

I would start by putting your code in the code behind instead of embedding it in the page. If you do embed it in the page then I think you need to specify the language as C# .

In addition to that, your code doesn't look like it will work, and if you modify it so it will, you will be open to a SQL Injection attack. I recommend the following steps:

1. Move your click event to the code behind
2. Read up on Parameterized Queries

Your method for accessing the textbox seems unnecessarily complex as well. Is there a reason you are using FindControl instead of just using the control's name?

Answer 2

Why invent login and signup code when Visual Studio and C# provide extremely good out of the box templates in WebForms and MVC that have a complete user registration system built in.

Have a look at the templates when creating a new VS project (my example is from VS2012) and select

"Visual C# -> Web-> ASP.NET Web Forms Application"

OR

"Visual C# -> Web -> ASP.NET MVC 4 Web Application -> Internet Application"

These will give you significantly stronger starting points, remove the amount of code you need to write for yourself, and be significantly less prone to SQL injection attacks.