Compare Text Box field to Server-side DB using ASP.NET (VB.NET)

Question

I'm currently working on producing a quoting system that will run with a webform front end and be populated using a database on a server (ASP.NET).

I'm reasonably competent in how databases work and how to write HTML/CSS but still a novice at linking the two together by running VB.NET at the server using code behind.

So far I've created an .aspx page and used the code below to create my form:

    <form id="LoginForm" runat="server" method="post">
            <div class="row email">
                <asp:TextBox ID="email" placeholder="Email" TextMode="Email" runat="server"></asp:TextBox>
            </div>

            <div class="row pass">
                <asp:TextBox ID="password" placeholder="Password" TextMode="Password" runat="server"></asp:TextBox>
            </div>

            <asp:Button ID="submit" runat="server" Text="Submit" OnClick="submit_Click" />

        </form>

I have a database I want to compare the email and password to on the server. I understand this would be on click but what is the easiest method of going about this?

So far I have linked "CodeBehind" and a sub ready for

Protected Sub submit_Click(sender As Object, e As EventArgs) Handles submit.Click

As far as I've been able to understand, I need to open a database connection? Use ADO? Implement a SQL query somehow?

There's a lot of these terms on various forums and sites but much detail on what they do or how they interact for beginners like myself. Any help on what basic methods to take would be fantastic or any links to sites that explained all this would be great too. It doesn't need to be hugely secure as this project is for learning purposes more than a robust system.

NOTE: I did produce a similar form on Access where I treat the textbox fields as variables and ran a SQL query with them inside. If correct it allowed access if false it asked the user to try again. Would this be a similar method?

Answer 1

Here's a simple example on how you could do it, there are various others like using an ASP.NET Memberhsip provider:

Protected Sub submit_Click(sender As Object, e As EventArgs) Handles submit.Click
    Dim sql = "SELECT u.* FROM dbo.Users u WHERE u.UserName=@Username AND u.PassWord=@Password"
    Using con As New SqlConnection(My.Settings.ConnectionString)
        Using cmd As New SqlCommand(sql, con)
            cmd.Parameters.Add("@Username", SqlDbType.VarChar, 100).Value = email.Text
            cmd.Parameters.Add("@Password", SqlDbType.VarChar, 50).Value = password.Text
            con.Open()
            Using rd = cmd.ExecuteReader()
                Dim userExists As Boolean = rd.HasRows
                If userExists Then
                    While rd.Read()
                        Dim dateBirth = rd.GetDateTime(rd.GetOrdinal("DateOfBirth"))
                        ' .... '
                    End While
                End If
            End Using
        End Using
    End Using
End Sub

You could also use a SqlDataAdapter to fill a DataTable . It's also a good idea to implement a User class and use the loop above to fill a List(Of User) .