authenticating login level using sessions in asp.net c#

Question

im having a simple login page which i have created using asp.net c#. What im trying to do is retrieve the user level and assign it to a session and redirect to the appropriate page based on the level. But when i login nothing happens.. below is my code. can someone tell me what is wrong with my code?

 con.Open();
        com.CommandText = "Select * from deatls Where c_id = '" + TextBox1.Text + "' and password = '" + TextBox2.Text + "'";
        com.CommandType = CommandType.Text;
        com.Connection = con;

        SqlDataReader sqlread = com.ExecuteReader();


        if (sqlread.Read())
        {
            Session["level"] = sqlread["level"];   
        }


        if ((int)Session["level"] == '1') 

            Response.Redirect("customer_menu.aspx");

        if ((int)Session["level"] == '2' )

            Response.Redirect("front.aspx");

        if  ((int)Session["level"] == '3')

            Response.Redirect("manager.aspx");

        else  
            Response.Redirect("login.aspx");

        con.Close();

That is some really security flawed SQL code. Please don't use that in production, it is exactly what hackers try to do SQL Injection Attacks. — Erik Philips
– Erik Philips, Commented Jul 11, 2013 at 17:46
Why not step through it with a debugger, check what the query is returning, check Session["level"] gets assigned etc. — T I
– T I, Commented Jul 11, 2013 at 17:53
@LiveEn: What will happen if sqlread.Read() returns false? You need to test that case. — Taylor
– Taylor, Commented Jul 11, 2013 at 21:38
BTW, LiveEn...you should really take a look at the built in security features of ASP.NET Walkthrough: Using Forms Authentication in ASP.NET MVC. You are essentially rolling your own users and roles framework here. If you want to, as a learning exercise, then so be it. But there are better ways. — Taylor
– Taylor, Commented Jul 11, 2013 at 21:47

Karl Anderson · Accepted Answer · 2013-07-11 17:49:04Z

2

Your code is begging for a switch statement, like this:

switch (Session["level"].ToString())
{
    case "1":
        Response.Redirect("customer_menu.aspx");
        break;
    case "2":
        Response.Redirect("front.aspx");
        break;
    case "3":
        Response.Redirect("manager.aspx");
        break;
    default:
        Response.Redirect("login.aspx");
        break;
}

answered Jul 11, 2013 at 17:49

Karl Anderson

34.9k12 gold badges69 silver badges83 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Taylor Over a year ago

I totally agree. I would certainly use a switch statement here.

ridoy · Accepted Answer · 2013-07-11 18:24:32Z

1

For starters you are casting Session["level"] to an int and then checking for equality with a string (or attempting to). Secondarily you are using single quotes for the values you want to check. Does this code compile? Do you have exception handling? My guess is that it errors and does not run at all. Can you post the full code?

TheGeekYouNeed is right. You should first try removing the single quotes from the integer values you want to check.

edited Jul 11, 2013 at 18:24

ridoy

6,3722 gold badges32 silver badges60 bronze badges

answered Jul 11, 2013 at 17:43

Taylor

7011 gold badge8 silver badges15 bronze badges

4 Comments

T I Over a year ago

op is checking int against a char not a string

Taylor Over a year ago

Also, this type of user auth query is typically avoided due to the possibility of SQL injection. You should read up a bit on that.

TheGeekYouNeed Over a year ago

The single quotes need removed since the value is being casted to an int.

LiveEn Over a year ago

The single quotes was the mistake,, fixed it now... Thanks :)

Collectives™ on Stack Overflow

authenticating login level using sessions in asp.net c#

2 Answers 2

1 Comment

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related