SQL Selects after logging in with a session

fergus

Hi,

my first post on here so please forgive me if its done badly.

I have an asp login page connected to sql database. user logs in based on information matching the sql table. I have also got a session functioning. I am i the very early days of my project. so after i log the user in they are redirected to a Dashboard page and i can display their user id which was assigned to the session. The next step is i want to display other attributes from the database table like name and age etc.

so this is the code i have on the login page:

 protected void Button1_Click(object sender, EventArgs e)
 {
     try
     {
         string uid = TextBox1.Text;
         string pass = TextBox2.Text;

         myCon.Open();
         string qry = "select userId from users where userId='" + uid + "' and Password='" + pass + "'";
         SqlCommand cmd = new SqlCommand(qry, myCon);
         SqlDataReader sdr = cmd.ExecuteReader();
         if (sdr.Read())
         {
             Session["userId"] = uid.Trim();
             Response.Redirect("Dashboard.aspx");
         }
         else
         {
             Label4.Text = "UserId & Password Is not correct Try again..!!";
         }
         myCon.Close();
     }
     catch(Exception ex){
         Response.Write(ex.Message);
     }
 }

On the dashboard page i have the following:

        protected void Page_Load(object sender, EventArgs e)
        {
            if (Session["userId"] == null)
                Response.Redirect("Login.aspx");
            SessionLabel.Text = "Username : " + Session["userId"];


        }

        protected void ButtonLogout_Click(object sender, EventArgs e)
        {
            Session.Abandon();
            Response.Redirect("Login.aspx");
        }

Do i need to define another connection now and create another select based on the session information or what is good practice to pull in sql data after a login?

Many Thnaks

Gus

2 Replies

Know the answer? Post it — somebody with the same question will find it here.

fergus2y ago
oh fantastic thank you. yes i am very concious of making everything secure. could you give me an example of pamaterizied query please?
Jayraj Chhaya2y ago
To retrieve additional attributes like name and age from the database table after login, you can follow best practices by enhancing your existing code. Instead of creating a new database connection, you can utilize the existing connection established during login. Here's a recommended approach:
1. Modify the Login Page Code: After successful login, store additional user information in the session along with the user ID. Update your login page code to fetch and store the required user details in the session.
2. Retrieve Additional Data on Dashboard: In the Dashboard page, utilize the existing database connection to fetch the user's name and age based on the stored user ID in the session. You can execute a new SQL query to retrieve this information.
3. Display Additional Attributes: Once you retrieve the name and age from the database, you can display them on the Dashboard page alongside the user ID.
By following this approach, you can efficiently retrieve and display additional user attributes without the need for a new database connection. Remember to handle exceptions and ensure data security by using parameterized queries to prevent SQL injection attacks. This practice maintains code efficiency and enhances the user experience.