How to solve ASP.NET custom login page error?

Question

In Login.aspx.cs file

The codes are following

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Configuration;
using System.Data;
using System.Web.Configuration;

namespace Leave_Management
{
    public partial class Login : System.Web.UI.Page
    {
        //private string strcon = WebConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString;

        SqlConnection conn = new SqlConnection(@"Data Source=TAUFIQ-PC\SQLEXPRESS;Initial Catalog=LM;Integrated Security=True");

        protected void Page_Load(object sender, EventArgs e)
        {

        }

        protected void Button1_Click(object sender, EventArgs e)
        {
            conn.Open();
            string checkuser = "select UserName from [User] where UserName='" + TextBoxUN + "'";
            SqlCommand com = new SqlCommand(checkuser, conn);

            int temp = Convert.ToInt32(com.ExecuteScalar().ToString());


            if (temp == 1)
            {
                string checkpass = "select password from [User] where UserName='" + TextBoxUN + "'";
                SqlCommand passcom = new SqlCommand(checkpass, conn);
                string password = passcom.ExecuteScalar().ToString().Replace(" ", "");
                conn.Close();
                if (password == TextBoxPass.Text)
                {
                    Response.Redirect("Registration.aspx");
                }
            } 
        }
    }
}

An Error is showing as

"NullReferenceException was unhandled by user code"

int temp = Convert.ToInt32(com.ExecuteScalar().ToString());

Please help me to solve this.

are you trying to convert string to int? this will cause error when string contains non-numeric values — Anonymous Duck, May 31 '15 at 05:32

score 1 · Answer 1 · answered May 31 '15 at 06:03

Too long for a comment, there are many things wrong with your code:

You are concatenating user-specified values into SQL queries. Don't do it, use parameters.

You are putting TextBoxUN into the SQL, you probably want TextBoxUN.Text. This is the reason you get null, since there is no user with that name.

You must take the value provided by ExecuteScalar() and check if it is null. Now it is, so you get a clear error about it.

Why get the username from the database with the username and then check for password? You can check for password and username with one query.

Do not store passwords in cleartext in the database! Use hash functions.

**Thank you very much! Yea I have to focus on coding properly.** I'm the beginner in programming. Would you suggest me how to learn programming by books or resource? — Taufiqur Rahman, May 31 '15 at 06:47

score 1 · Accepted Answer · edited May 23 '17 at 12:14

You can just simplify your code by checking both username and password from the SQL statement:

protected void Button1_Click(object sender, EventArgs e)
{
    conn.Open();
    string SQL = "select UserID from [User] where UserName=@UserName AND Password=@Password"; 
    SqlCommand com = new SqlCommand(SQL, conn);
    com.Parameters.AddWithValue("@UserName", TextBoxUN.Text);
    com.Parameters.AddWithValue("@Password", TextBoxPass.Text);
    SqlDataReader data = com.ExecuteReader();
    if (data.HasRows) // username and password match
    {
        conn.Close();
        Response.Redirect("Registration.aspx");
    }
    else
    {
        conn.Close();
        // display error here
    }
}

I assume that UserID is the primary key of your Users table. You can use other column names if you want.

I also used parameters to avoid SQL injection. Cheers!

**It works! Thanks for your code.** But something is missing: `string SQL = "select UserID from [User] where UserName=@UserName AND Password=@Password"; SqlCommand com = new SqlCommand(checkuser, conn);` just have to replace SQL by checkuser. — Taufiqur Rahman, May 31 '15 at 06:41

score 0 · Answer 3 · answered May 31 '15 at 05:38

0

if temp comes up as null, then you will get the error. I would try:

...

   int temp = 0;
   try {
       temp = Convert.ToInt32(com.ExecuteScalar().ToString());
   } catch (exception) {}

...

answered May 31 '15 at 05:38

SteveFerg

3,466
7
19
31

Using exceptions is expensive, especially when you can just check if it is null. – Sami Kuhmonen May 31 '15 at 05:59

How to solve ASP.NET custom login page error?

3 Answers3