An Approach To Better Registration And Login In ASP.NET

In this tutorial, we will see a better approach towards the registration and login process in an ASP.NET, using C#, where will see hash passwords and how we manage the password correctly in login form. Also, we will see how to authenticate the duplicate user during the registration process.

Prerequisites

Datatable having columns as username, password and an E-mail.
Store Procedure, where one for inserting and one for authentication.
3 Web Forms – Register.aspx, login.aspx, home.aspx

Initial Chamber

Step 1

Open Your Visual Studio 2015 and create an empty Website. Give a suitable name [RegForm_demo].

Step 2

In Solution Explorer, you get your empty Website, followed by adding three Web Forms and SQL Server database.

For Web Form

RegForm_demo (Your Empty Website) -> Right click -> Add New Item -> Web Form. Name it as Register.aspx. Now, go to the same process, add other Web form and name it --> login.aspx and home.aspx.

For SQL Server database

RegForm_demo (Your Empty Website) -> Right click -> Add New Item -> SQL Server database. Add the database inside the App_Data_folder.

Database Chamber

Step 3

In Server Explorer, click on your database [Database.mdf] - -> Tables - -> Add New Table - -> Make the table, as shown below.

Store Procedure

sp_insert

CREATE PROCEDURE [dbo].[sp_insert]
(
-- Add the parameters for the stored procedure here
@Username varchar(50),
@Password varchar(50),
@Email varchar(50)
)
as
Begin
Declare @Count int
Declare @codereturn int
Select @Count = COUNT(Username)
from tbl_data where Username = @Username
If @Count > 0
Begin
Set @codereturn = -1
End
Else
Begin
Set @codereturn = 1
Insert into tbl_data values(@Username,@Password,@Email)
End
Select @codereturn as ReturnValue
End

sp_select

CREATE PROCEDURE sp_select
@Username varchar(50),
@Password varchar(50)
AS
BEGIN
Declare @Count int
Select @Count = COUNT(Username)
from tbl_data where [Username] =@Username and [Password] =@Password
If (@Count = 1)
Begin
Select 1 as codereturn
End
Else
Begin
Select -1 as codereturn
End
END

Design code

Step 4

Now, make some design for your Application by going to Register.aspx and design it, as shown below.

Register.aspx

Login.aspx

Code Chamber

Step 5

We will make some code in Register.aspx.cs page, so that our Register form works.

Register.aspx.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Data;
using System.Data.Sql;
using System.Web.Security;
namespace WebApplication3
{
public partial class Register : System.Web.UI.Page
{
protected void Button1_Click(object sender, EventArgs e)
{
SqlConnection con = new SqlConnection(@"Data Source=Nilesh;Initial Catalog=test_db;Integrated Security=True");
SqlCommand cmd = new SqlCommand("sp_insert", con);
cmd.CommandType = CommandType.StoredProcedure;
string encryp = FormsAuthentication.HashPasswordForStoringInConfigFile(TextBox2.Text, "SHA1");
cmd.Parameters.AddWithValue("@Username", TextBox1.Text);
cmd.Parameters.AddWithValue("@Password", encryp);
cmd.Parameters.AddWithValue("@Email", TextBox4.Text);
con.Open();
int codereturn = (int)cmd.ExecuteScalar();
if (codereturn == -1)
{
lblmsg.Text = "Username already exist!";
lblmsg.ForeColor = System.Drawing.Color.Red;
}
else
{
Response.Redirect("~/Login.aspx");
}
}
}
}

Login.aspx.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data;
using System.Data.SqlClient;
using System.Web.Security;
namespace WebApplication3
{
public partial class Login : System.Web.UI.Page
{
protected void Button1_Click(object sender, EventArgs e)
{
if (authenticate(TextBox1.Text, TextBox2.Text))
{
Response.Redirect("~/Home.aspx");
}
else
{
Label1.Text = "Invalid Username and Password";
Label1.ForeColor = System.Drawing.Color.Red;
}
}
private bool authenticate(string Username, string Passsword)
{
SqlConnection con = new SqlConnection(@"Data Source=Nilesh;Initial Catalog=test_db;Integrated Security=True");
SqlCommand cmd = new SqlCommand("sp_select", con);
cmd.CommandType = CommandType.StoredProcedure;
string encryp = FormsAuthentication.HashPasswordForStoringInConfigFile(TextBox2.Text, "SHA1");
cmd.Parameters.AddWithValue("@Username", TextBox1.Text);
cmd.Parameters.AddWithValue("@Password",encryp);
con.Open();
int codereturn = (int)cmd.ExecuteScalar();
return codereturn == 1;
}
}
}

Output

The user is registering with the username abc and password abc too, and if successful, the login page will open, else the respective error message will be shown. Also, this data is saved in the database, as shown below. You can see the password is encrypted in hash format.

Let’s say, the user abc is registered and now another user comes. Register with the same username as abc and the authenticate procedure will call and an error will be shown, as given below.

Login page output

After successful registration, the user abc can access his account, using login access.

If login is successfuk, home page will be opened, else the respective error will be shown.

Hope, you liked it. Have a good day and thank you for reading.

7 Comments

Join the conversation! Your thoughts help the community grow.

kaushal kishore7y ago
This is not fully secured as password is passing in plain text from client to server. password must be encrypted before passing in authenticate(string Username, string Passsword) method.
Arvind More9y ago
Simple and Most useful using stored Procedure....... Thanks Bhava
- Nilesh Jadav9y ago
  I appreciate it for praising this :) thank you
kzelda link9y ago
Using "if exists" sql statement , is more faster than count.
- Nigel Fernandes9y ago
  Yes I agree "If Exists" would be faster
- Nilesh Jadav9y ago
  Thank u for the concern, I'll try it in my another module :)
- Foyz7y ago
  Nigel Fernandes or kzelda link Can you show an IF EXISTS variant of Nilesh's code please?