[briana evigan]

hi all,
i am trying to develop an asp.net website bu i have an error in redirected from login form to the homepage

the code of my login.aspx.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Configuration;

public partial class Login : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {

    }
    protected void Button1_Click(object sender, EventArgs e)
    {
        SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["RegConnectionString"].ConnectionString);
        con.Open();
        string cmdStr = "select count(*) from registration where UserName='" + TextBox1.Text + "'";
        SqlCommand Checkuser = new SqlCommand(cmdStr, con);
        int temp = Convert.ToInt32(Checkuser.ExecuteNonQuery().ToString());
        if (temp == 1)
        {
            string cmdStr2 = "select Password from Registration where UserName='" + TextBox1.Text + "'";
            SqlCommand pass = new SqlCommand(cmdStr2, con);
            string password = pass.ExecuteNonQuery().ToString();
            con.Close();

            if (password == TextBox2.Text)
            {
                Session["New"] = TextBox1.Text;
                Response.Redirect("Secure.aspx");
            }
            else
            {
                Label1.Visible = true;
                Label1.Text = "Invalid Password...!!";
            }
        }
        else
        {
            Label1.Visible = true;
            Label1.Text = "Invalid UserName...!!";
        }

    }
}

the debug error




snapshot of the database





although the user is registered in the database, the debug said "invalid user name"
i couldn't know where is the error??

[Takk]

Using ExecuteNonQuery is designed to not return a value, it is very likely that password is not being populated correctly on line 26 above. This should be ExecuteQuery. However keep in mind, the method which you are using to create your query string leaves you open to SQL injection attacks and should likely be revisited if this site will go live. A search should turn up some options as to a better explanation of this and how you can avoid it.

Hope this helps.

[GunnerInc]

Duplicate... closed